pulumi-vault 7.1.0__py3-none-any.whl → 7.2.0__py3-none-any.whl
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- pulumi_vault/__init__.py +19 -1
- pulumi_vault/_inputs.py +873 -673
- pulumi_vault/ad/__init__.py +1 -1
- pulumi_vault/ad/get_access_credentials.py +27 -28
- pulumi_vault/ad/secret_backend.py +579 -580
- pulumi_vault/ad/secret_library.py +120 -121
- pulumi_vault/ad/secret_role.py +104 -105
- pulumi_vault/alicloud/__init__.py +1 -1
- pulumi_vault/alicloud/auth_backend_role.py +222 -223
- pulumi_vault/approle/__init__.py +1 -1
- pulumi_vault/approle/auth_backend_login.py +138 -139
- pulumi_vault/approle/auth_backend_role.py +292 -293
- pulumi_vault/approle/auth_backend_role_secret_id.py +202 -203
- pulumi_vault/approle/get_auth_backend_role_id.py +23 -24
- pulumi_vault/audit.py +103 -104
- pulumi_vault/audit_request_header.py +52 -53
- pulumi_vault/auth_backend.py +132 -133
- pulumi_vault/aws/__init__.py +1 -1
- pulumi_vault/aws/auth_backend_cert.py +86 -87
- pulumi_vault/aws/auth_backend_client.py +307 -308
- pulumi_vault/aws/auth_backend_config_identity.py +103 -104
- pulumi_vault/aws/auth_backend_identity_whitelist.py +69 -70
- pulumi_vault/aws/auth_backend_login.py +258 -259
- pulumi_vault/aws/auth_backend_role.py +486 -487
- pulumi_vault/aws/auth_backend_role_tag.py +155 -156
- pulumi_vault/aws/auth_backend_roletag_blacklist.py +69 -70
- pulumi_vault/aws/auth_backend_sts_role.py +86 -87
- pulumi_vault/aws/get_access_credentials.py +59 -60
- pulumi_vault/aws/get_static_access_credentials.py +19 -20
- pulumi_vault/aws/secret_backend.py +1016 -439
- pulumi_vault/aws/secret_backend_role.py +256 -257
- pulumi_vault/aws/secret_backend_static_role.py +137 -138
- pulumi_vault/azure/__init__.py +1 -1
- pulumi_vault/azure/_inputs.py +26 -27
- pulumi_vault/azure/auth_backend_config.py +222 -223
- pulumi_vault/azure/auth_backend_role.py +307 -308
- pulumi_vault/azure/backend.py +1057 -285
- pulumi_vault/azure/backend_role.py +194 -195
- pulumi_vault/azure/get_access_credentials.py +75 -76
- pulumi_vault/azure/outputs.py +16 -17
- pulumi_vault/cert_auth_backend_role.py +443 -444
- pulumi_vault/config/__init__.py +1 -1
- pulumi_vault/config/__init__.pyi +1 -2
- pulumi_vault/config/_inputs.py +13 -14
- pulumi_vault/config/outputs.py +380 -381
- pulumi_vault/config/ui_custom_message.py +140 -141
- pulumi_vault/config/vars.py +31 -32
- pulumi_vault/consul/__init__.py +1 -1
- pulumi_vault/consul/secret_backend.py +887 -256
- pulumi_vault/consul/secret_backend_role.py +222 -223
- pulumi_vault/database/__init__.py +1 -1
- pulumi_vault/database/_inputs.py +3167 -3168
- pulumi_vault/database/outputs.py +2123 -2124
- pulumi_vault/database/secret_backend_connection.py +259 -260
- pulumi_vault/database/secret_backend_role.py +205 -206
- pulumi_vault/database/secret_backend_static_role.py +218 -219
- pulumi_vault/database/secrets_mount.py +426 -380
- pulumi_vault/egp_policy.py +86 -87
- pulumi_vault/gcp/__init__.py +1 -1
- pulumi_vault/gcp/_inputs.py +98 -99
- pulumi_vault/gcp/auth_backend.py +322 -323
- pulumi_vault/gcp/auth_backend_role.py +347 -348
- pulumi_vault/gcp/get_auth_backend_role.py +91 -92
- pulumi_vault/gcp/outputs.py +66 -67
- pulumi_vault/gcp/secret_backend.py +878 -336
- pulumi_vault/gcp/secret_impersonated_account.py +112 -113
- pulumi_vault/gcp/secret_roleset.py +115 -116
- pulumi_vault/gcp/secret_static_account.py +115 -116
- pulumi_vault/generic/__init__.py +1 -1
- pulumi_vault/generic/endpoint.py +138 -139
- pulumi_vault/generic/get_secret.py +39 -40
- pulumi_vault/generic/secret.py +95 -96
- pulumi_vault/get_auth_backend.py +29 -30
- pulumi_vault/get_auth_backends.py +19 -20
- pulumi_vault/get_namespace.py +21 -22
- pulumi_vault/get_namespaces.py +19 -20
- pulumi_vault/get_nomad_access_token.py +25 -26
- pulumi_vault/get_policy_document.py +10 -11
- pulumi_vault/get_raft_autopilot_state.py +31 -32
- pulumi_vault/github/__init__.py +1 -1
- pulumi_vault/github/_inputs.py +50 -51
- pulumi_vault/github/auth_backend.py +285 -286
- pulumi_vault/github/outputs.py +34 -35
- pulumi_vault/github/team.py +69 -70
- pulumi_vault/github/user.py +69 -70
- pulumi_vault/identity/__init__.py +1 -1
- pulumi_vault/identity/entity.py +103 -104
- pulumi_vault/identity/entity_alias.py +86 -87
- pulumi_vault/identity/entity_policies.py +78 -79
- pulumi_vault/identity/get_entity.py +62 -63
- pulumi_vault/identity/get_group.py +75 -76
- pulumi_vault/identity/get_oidc_client_creds.py +19 -20
- pulumi_vault/identity/get_oidc_openid_config.py +39 -40
- pulumi_vault/identity/get_oidc_public_keys.py +17 -18
- pulumi_vault/identity/group.py +171 -172
- pulumi_vault/identity/group_alias.py +69 -70
- pulumi_vault/identity/group_member_entity_ids.py +69 -70
- pulumi_vault/identity/group_member_group_ids.py +69 -70
- pulumi_vault/identity/group_policies.py +78 -79
- pulumi_vault/identity/mfa_duo.py +183 -184
- pulumi_vault/identity/mfa_login_enforcement.py +147 -148
- pulumi_vault/identity/mfa_okta.py +166 -167
- pulumi_vault/identity/mfa_pingid.py +160 -161
- pulumi_vault/identity/mfa_totp.py +217 -218
- pulumi_vault/identity/oidc.py +35 -36
- pulumi_vault/identity/oidc_assignment.py +69 -70
- pulumi_vault/identity/oidc_client.py +155 -156
- pulumi_vault/identity/oidc_key.py +103 -104
- pulumi_vault/identity/oidc_key_allowed_client_id.py +52 -53
- pulumi_vault/identity/oidc_provider.py +112 -113
- pulumi_vault/identity/oidc_role.py +103 -104
- pulumi_vault/identity/oidc_scope.py +69 -70
- pulumi_vault/identity/outputs.py +42 -43
- pulumi_vault/jwt/__init__.py +1 -1
- pulumi_vault/jwt/_inputs.py +50 -51
- pulumi_vault/jwt/auth_backend.py +400 -354
- pulumi_vault/jwt/auth_backend_role.py +494 -495
- pulumi_vault/jwt/outputs.py +34 -35
- pulumi_vault/kmip/__init__.py +1 -1
- pulumi_vault/kmip/secret_backend.py +1006 -227
- pulumi_vault/kmip/secret_role.py +358 -359
- pulumi_vault/kmip/secret_scope.py +69 -70
- pulumi_vault/kubernetes/__init__.py +1 -1
- pulumi_vault/kubernetes/auth_backend_config.py +171 -172
- pulumi_vault/kubernetes/auth_backend_role.py +273 -274
- pulumi_vault/kubernetes/get_auth_backend_config.py +57 -58
- pulumi_vault/kubernetes/get_auth_backend_role.py +87 -88
- pulumi_vault/kubernetes/get_service_account_token.py +51 -52
- pulumi_vault/kubernetes/secret_backend.py +431 -385
- pulumi_vault/kubernetes/secret_backend_role.py +239 -240
- pulumi_vault/kv/__init__.py +1 -1
- pulumi_vault/kv/_inputs.py +25 -26
- pulumi_vault/kv/get_secret.py +25 -26
- pulumi_vault/kv/get_secret_subkeys_v2.py +39 -40
- pulumi_vault/kv/get_secret_v2.py +41 -42
- pulumi_vault/kv/get_secrets_list.py +17 -18
- pulumi_vault/kv/get_secrets_list_v2.py +25 -26
- pulumi_vault/kv/outputs.py +17 -18
- pulumi_vault/kv/secret.py +61 -62
- pulumi_vault/kv/secret_backend_v2.py +86 -87
- pulumi_vault/kv/secret_v2.py +184 -185
- pulumi_vault/ldap/__init__.py +1 -1
- pulumi_vault/ldap/auth_backend.py +716 -717
- pulumi_vault/ldap/auth_backend_group.py +69 -70
- pulumi_vault/ldap/auth_backend_user.py +86 -87
- pulumi_vault/ldap/get_dynamic_credentials.py +27 -28
- pulumi_vault/ldap/get_static_credentials.py +29 -30
- pulumi_vault/ldap/secret_backend.py +732 -693
- pulumi_vault/ldap/secret_backend_dynamic_role.py +154 -155
- pulumi_vault/ldap/secret_backend_library_set.py +120 -121
- pulumi_vault/ldap/secret_backend_static_role.py +120 -121
- pulumi_vault/managed/__init__.py +1 -1
- pulumi_vault/managed/_inputs.py +274 -275
- pulumi_vault/managed/keys.py +27 -28
- pulumi_vault/managed/outputs.py +184 -185
- pulumi_vault/mfa_duo.py +137 -138
- pulumi_vault/mfa_okta.py +137 -138
- pulumi_vault/mfa_pingid.py +149 -150
- pulumi_vault/mfa_totp.py +154 -155
- pulumi_vault/mongodbatlas/__init__.py +1 -1
- pulumi_vault/mongodbatlas/secret_backend.py +78 -79
- pulumi_vault/mongodbatlas/secret_role.py +188 -189
- pulumi_vault/mount.py +380 -334
- pulumi_vault/namespace.py +78 -79
- pulumi_vault/nomad_secret_backend.py +909 -271
- pulumi_vault/nomad_secret_role.py +103 -104
- pulumi_vault/oci_auth_backend.py +683 -0
- pulumi_vault/oci_auth_backend_role.py +798 -0
- pulumi_vault/okta/__init__.py +1 -1
- pulumi_vault/okta/_inputs.py +31 -32
- pulumi_vault/okta/auth_backend.py +305 -306
- pulumi_vault/okta/auth_backend_group.py +69 -70
- pulumi_vault/okta/auth_backend_user.py +86 -87
- pulumi_vault/okta/outputs.py +21 -22
- pulumi_vault/outputs.py +234 -82
- pulumi_vault/pkisecret/__init__.py +1 -1
- pulumi_vault/pkisecret/_inputs.py +55 -56
- pulumi_vault/pkisecret/backend_acme_eab.py +116 -117
- pulumi_vault/pkisecret/backend_config_acme.py +175 -176
- pulumi_vault/pkisecret/backend_config_auto_tidy.py +394 -395
- pulumi_vault/pkisecret/backend_config_cluster.py +71 -72
- pulumi_vault/pkisecret/backend_config_cmpv2.py +132 -133
- pulumi_vault/pkisecret/backend_config_est.py +149 -150
- pulumi_vault/pkisecret/backend_config_scep.py +205 -159
- pulumi_vault/pkisecret/get_backend_cert_metadata.py +37 -38
- pulumi_vault/pkisecret/get_backend_config_cmpv2.py +32 -33
- pulumi_vault/pkisecret/get_backend_config_est.py +30 -31
- pulumi_vault/pkisecret/get_backend_config_scep.py +50 -31
- pulumi_vault/pkisecret/get_backend_issuer.py +63 -64
- pulumi_vault/pkisecret/get_backend_issuers.py +23 -24
- pulumi_vault/pkisecret/get_backend_key.py +29 -30
- pulumi_vault/pkisecret/get_backend_keys.py +23 -24
- pulumi_vault/pkisecret/outputs.py +61 -62
- pulumi_vault/pkisecret/secret_backend_cert.py +415 -416
- pulumi_vault/pkisecret/secret_backend_config_ca.py +54 -55
- pulumi_vault/pkisecret/secret_backend_config_issuers.py +75 -76
- pulumi_vault/pkisecret/secret_backend_config_urls.py +105 -106
- pulumi_vault/pkisecret/secret_backend_crl_config.py +241 -242
- pulumi_vault/pkisecret/secret_backend_intermediate_cert_request.py +515 -516
- pulumi_vault/pkisecret/secret_backend_intermediate_set_signed.py +78 -79
- pulumi_vault/pkisecret/secret_backend_issuer.py +286 -287
- pulumi_vault/pkisecret/secret_backend_key.py +146 -147
- pulumi_vault/pkisecret/secret_backend_role.py +873 -874
- pulumi_vault/pkisecret/secret_backend_root_cert.py +677 -678
- pulumi_vault/pkisecret/secret_backend_root_sign_intermediate.py +660 -661
- pulumi_vault/pkisecret/secret_backend_sign.py +346 -347
- pulumi_vault/plugin.py +154 -155
- pulumi_vault/plugin_pinned_version.py +52 -53
- pulumi_vault/policy.py +52 -53
- pulumi_vault/provider.py +160 -161
- pulumi_vault/pulumi-plugin.json +1 -1
- pulumi_vault/quota_lease_count.py +103 -104
- pulumi_vault/quota_rate_limit.py +171 -172
- pulumi_vault/rabbitmq/__init__.py +1 -1
- pulumi_vault/rabbitmq/_inputs.py +50 -51
- pulumi_vault/rabbitmq/outputs.py +34 -35
- pulumi_vault/rabbitmq/secret_backend.py +902 -231
- pulumi_vault/rabbitmq/secret_backend_role.py +79 -80
- pulumi_vault/raft_autopilot.py +137 -138
- pulumi_vault/raft_snapshot_agent_config.py +477 -478
- pulumi_vault/rgp_policy.py +69 -70
- pulumi_vault/saml/__init__.py +1 -1
- pulumi_vault/saml/auth_backend.py +188 -189
- pulumi_vault/saml/auth_backend_role.py +290 -291
- pulumi_vault/scep_auth_backend_role.py +252 -253
- pulumi_vault/secrets/__init__.py +1 -1
- pulumi_vault/secrets/_inputs.py +19 -20
- pulumi_vault/secrets/outputs.py +13 -14
- pulumi_vault/secrets/sync_association.py +88 -89
- pulumi_vault/secrets/sync_aws_destination.py +180 -181
- pulumi_vault/secrets/sync_azure_destination.py +180 -181
- pulumi_vault/secrets/sync_config.py +52 -53
- pulumi_vault/secrets/sync_gcp_destination.py +129 -130
- pulumi_vault/secrets/sync_gh_destination.py +163 -164
- pulumi_vault/secrets/sync_github_apps.py +78 -79
- pulumi_vault/secrets/sync_vercel_destination.py +146 -147
- pulumi_vault/ssh/__init__.py +1 -1
- pulumi_vault/ssh/_inputs.py +13 -14
- pulumi_vault/ssh/get_secret_backend_sign.py +65 -66
- pulumi_vault/ssh/outputs.py +9 -10
- pulumi_vault/ssh/secret_backend_ca.py +217 -124
- pulumi_vault/ssh/secret_backend_role.py +446 -447
- pulumi_vault/terraformcloud/__init__.py +1 -1
- pulumi_vault/terraformcloud/secret_backend.py +833 -155
- pulumi_vault/terraformcloud/secret_creds.py +93 -94
- pulumi_vault/terraformcloud/secret_role.py +117 -118
- pulumi_vault/token.py +301 -302
- pulumi_vault/tokenauth/__init__.py +1 -1
- pulumi_vault/tokenauth/auth_backend_role.py +324 -325
- pulumi_vault/transform/__init__.py +1 -1
- pulumi_vault/transform/alphabet.py +69 -70
- pulumi_vault/transform/get_decode.py +57 -58
- pulumi_vault/transform/get_encode.py +57 -58
- pulumi_vault/transform/role.py +69 -70
- pulumi_vault/transform/template.py +137 -138
- pulumi_vault/transform/transformation.py +171 -172
- pulumi_vault/transit/__init__.py +1 -1
- pulumi_vault/transit/get_cmac.py +47 -48
- pulumi_vault/transit/get_decrypt.py +25 -26
- pulumi_vault/transit/get_encrypt.py +29 -30
- pulumi_vault/transit/get_sign.py +71 -72
- pulumi_vault/transit/get_verify.py +83 -84
- pulumi_vault/transit/secret_backend_key.py +377 -350
- pulumi_vault/transit/secret_cache_config.py +52 -53
- {pulumi_vault-7.1.0.dist-info → pulumi_vault-7.2.0.dist-info}/METADATA +1 -1
- pulumi_vault-7.2.0.dist-info/RECORD +270 -0
- pulumi_vault-7.1.0.dist-info/RECORD +0 -268
- {pulumi_vault-7.1.0.dist-info → pulumi_vault-7.2.0.dist-info}/WHEEL +0 -0
- {pulumi_vault-7.1.0.dist-info → pulumi_vault-7.2.0.dist-info}/top_level.txt +0 -0
|
@@ -2,8 +2,7 @@
|
|
|
2
2
|
# *** WARNING: this file was generated by pulumi-language-python. ***
|
|
3
3
|
# *** Do not edit by hand unless you're certain you know what you are doing! ***
|
|
4
4
|
|
|
5
|
-
import builtins
|
|
6
|
-
import copy
|
|
5
|
+
import builtins as _builtins
|
|
7
6
|
import warnings
|
|
8
7
|
import sys
|
|
9
8
|
import pulumi
|
|
@@ -20,48 +19,52 @@ __all__ = ['SecretBackendKeyArgs', 'SecretBackendKey']
|
|
|
20
19
|
@pulumi.input_type
|
|
21
20
|
class SecretBackendKeyArgs:
|
|
22
21
|
def __init__(__self__, *,
|
|
23
|
-
backend: pulumi.Input[
|
|
24
|
-
allow_plaintext_backup: Optional[pulumi.Input[
|
|
25
|
-
auto_rotate_period: Optional[pulumi.Input[
|
|
26
|
-
convergent_encryption: Optional[pulumi.Input[
|
|
27
|
-
deletion_allowed: Optional[pulumi.Input[
|
|
28
|
-
derived: Optional[pulumi.Input[
|
|
29
|
-
exportable: Optional[pulumi.Input[
|
|
30
|
-
hybrid_key_type_ec: Optional[pulumi.Input[
|
|
31
|
-
hybrid_key_type_pqc: Optional[pulumi.Input[
|
|
32
|
-
key_size: Optional[pulumi.Input[
|
|
33
|
-
min_decryption_version: Optional[pulumi.Input[
|
|
34
|
-
min_encryption_version: Optional[pulumi.Input[
|
|
35
|
-
name: Optional[pulumi.Input[
|
|
36
|
-
namespace: Optional[pulumi.Input[
|
|
37
|
-
parameter_set: Optional[pulumi.Input[
|
|
38
|
-
type: Optional[pulumi.Input[
|
|
22
|
+
backend: pulumi.Input[_builtins.str],
|
|
23
|
+
allow_plaintext_backup: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
24
|
+
auto_rotate_period: Optional[pulumi.Input[_builtins.int]] = None,
|
|
25
|
+
convergent_encryption: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
26
|
+
deletion_allowed: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
27
|
+
derived: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
28
|
+
exportable: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
29
|
+
hybrid_key_type_ec: Optional[pulumi.Input[_builtins.str]] = None,
|
|
30
|
+
hybrid_key_type_pqc: Optional[pulumi.Input[_builtins.str]] = None,
|
|
31
|
+
key_size: Optional[pulumi.Input[_builtins.int]] = None,
|
|
32
|
+
min_decryption_version: Optional[pulumi.Input[_builtins.int]] = None,
|
|
33
|
+
min_encryption_version: Optional[pulumi.Input[_builtins.int]] = None,
|
|
34
|
+
name: Optional[pulumi.Input[_builtins.str]] = None,
|
|
35
|
+
namespace: Optional[pulumi.Input[_builtins.str]] = None,
|
|
36
|
+
parameter_set: Optional[pulumi.Input[_builtins.str]] = None,
|
|
37
|
+
type: Optional[pulumi.Input[_builtins.str]] = None):
|
|
39
38
|
"""
|
|
40
39
|
The set of arguments for constructing a SecretBackendKey resource.
|
|
41
|
-
:param pulumi.Input[
|
|
42
|
-
:param pulumi.Input[
|
|
40
|
+
:param pulumi.Input[_builtins.str] backend: The path the transit secret backend is mounted at, with no leading or trailing `/`s.
|
|
41
|
+
:param pulumi.Input[_builtins.bool] allow_plaintext_backup: Enables taking backup of entire keyring in the plaintext format. Once set, this cannot be disabled.
|
|
43
42
|
* Refer to Vault API documentation on key backups for more information: [Backup Key](https://www.vaultproject.io/api-docs/secret/transit#backup-key)
|
|
44
|
-
:param pulumi.Input[
|
|
43
|
+
:param pulumi.Input[_builtins.int] auto_rotate_period: Amount of seconds the key should live before being automatically rotated.
|
|
45
44
|
A value of 0 disables automatic rotation for the key.
|
|
46
|
-
:param pulumi.Input[
|
|
47
|
-
:param pulumi.Input[
|
|
48
|
-
:param pulumi.Input[
|
|
49
|
-
:param pulumi.Input[
|
|
50
|
-
:param pulumi.Input[
|
|
45
|
+
:param pulumi.Input[_builtins.bool] convergent_encryption: Whether or not to support convergent encryption, where the same plaintext creates the same ciphertext. This requires `derived` to be set to `true`.
|
|
46
|
+
:param pulumi.Input[_builtins.bool] deletion_allowed: Specifies if the key is allowed to be deleted.
|
|
47
|
+
:param pulumi.Input[_builtins.bool] derived: Specifies if key derivation is to be used. If enabled, all encrypt/decrypt requests to this key must provide a context which is used for key derivation.
|
|
48
|
+
:param pulumi.Input[_builtins.bool] exportable: Enables keys to be exportable. This allows for all valid private keys in the keyring to be exported. Once set, this cannot be disabled.
|
|
49
|
+
:param pulumi.Input[_builtins.str] hybrid_key_type_ec: The elliptic curve algorithm to use for hybrid signatures.
|
|
51
50
|
Supported key types are `ecdsa-p256`, `ecdsa-p384`, `ecdsa-p521`, and `ed25519`.
|
|
52
|
-
:param pulumi.Input[
|
|
51
|
+
:param pulumi.Input[_builtins.str] hybrid_key_type_pqc: The post-quantum algorithm to use for hybrid signatures.
|
|
53
52
|
Currently, ML-DSA is the only supported key type.
|
|
54
|
-
:param pulumi.Input[
|
|
55
|
-
:param pulumi.Input[
|
|
56
|
-
:param pulumi.Input[
|
|
57
|
-
:param pulumi.Input[
|
|
58
|
-
:param pulumi.Input[
|
|
53
|
+
:param pulumi.Input[_builtins.int] key_size: The key size in bytes for algorithms that allow variable key sizes. Currently only applicable to HMAC, where it must be between 32 and 512 bytes.
|
|
54
|
+
:param pulumi.Input[_builtins.int] min_decryption_version: Minimum key version to use for decryption.
|
|
55
|
+
:param pulumi.Input[_builtins.int] min_encryption_version: Minimum key version to use for encryption
|
|
56
|
+
:param pulumi.Input[_builtins.str] name: The name to identify this key within the backend. Must be unique within the backend.
|
|
57
|
+
:param pulumi.Input[_builtins.str] namespace: The namespace to provision the resource in.
|
|
59
58
|
The value should not contain leading or trailing forward slashes.
|
|
60
59
|
The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).
|
|
61
60
|
*Available only for Vault Enterprise*.
|
|
62
|
-
:param pulumi.Input[
|
|
63
|
-
ML-DSA and
|
|
64
|
-
|
|
61
|
+
:param pulumi.Input[_builtins.str] parameter_set: The parameter set to use for ML-DSA or SLH-DSA. Required for
|
|
62
|
+
ML-DSA, hybrid, and SLH-DSA keys.
|
|
63
|
+
Valid values for ML-DSA are `44`, `65`, and `87`.
|
|
64
|
+
Valid values for SLH-DSA are `slh-dsa-sha2-128s`, `slh-dsa-shake-128s`, `slh-dsa-sha2-128f`, `slh-dsa-shake-128`, `slh-dsa-sha2-192s`,
|
|
65
|
+
`slh-dsa-shake-192s`, `slh-dsa-sha2-192f`, `slh-dsa-shake-192f`, `slh-dsa-sha2-256s`, `slh-dsa-shake-256s`,
|
|
66
|
+
`slh-dsa-sha2-256f`, and `slh-dsa-shake-256f`.
|
|
67
|
+
:param pulumi.Input[_builtins.str] type: Specifies the type of key to create. The currently-supported types are: `aes128-gcm96`, `aes256-gcm96` (default), `chacha20-poly1305`, `ed25519`, `ecdsa-p256`, `ecdsa-p384`, `ecdsa-p521`, `hmac`, `rsa-2048`, `rsa-3072`, `rsa-4096`, `managed_key`, `aes128-cmac`, `aes192-cmac`, `aes256-cmac`, `ml-dsa`, `hybrid`, and `slh-dsa`.
|
|
65
68
|
* Refer to the Vault documentation on transit key types for more information: [Key Types](https://www.vaultproject.io/docs/secrets/transit#key-types)
|
|
66
69
|
"""
|
|
67
70
|
pulumi.set(__self__, "backend", backend)
|
|
@@ -96,21 +99,21 @@ class SecretBackendKeyArgs:
|
|
|
96
99
|
if type is not None:
|
|
97
100
|
pulumi.set(__self__, "type", type)
|
|
98
101
|
|
|
99
|
-
@property
|
|
102
|
+
@_builtins.property
|
|
100
103
|
@pulumi.getter
|
|
101
|
-
def backend(self) -> pulumi.Input[
|
|
104
|
+
def backend(self) -> pulumi.Input[_builtins.str]:
|
|
102
105
|
"""
|
|
103
106
|
The path the transit secret backend is mounted at, with no leading or trailing `/`s.
|
|
104
107
|
"""
|
|
105
108
|
return pulumi.get(self, "backend")
|
|
106
109
|
|
|
107
110
|
@backend.setter
|
|
108
|
-
def backend(self, value: pulumi.Input[
|
|
111
|
+
def backend(self, value: pulumi.Input[_builtins.str]):
|
|
109
112
|
pulumi.set(self, "backend", value)
|
|
110
113
|
|
|
111
|
-
@property
|
|
114
|
+
@_builtins.property
|
|
112
115
|
@pulumi.getter(name="allowPlaintextBackup")
|
|
113
|
-
def allow_plaintext_backup(self) -> Optional[pulumi.Input[
|
|
116
|
+
def allow_plaintext_backup(self) -> Optional[pulumi.Input[_builtins.bool]]:
|
|
114
117
|
"""
|
|
115
118
|
Enables taking backup of entire keyring in the plaintext format. Once set, this cannot be disabled.
|
|
116
119
|
* Refer to Vault API documentation on key backups for more information: [Backup Key](https://www.vaultproject.io/api-docs/secret/transit#backup-key)
|
|
@@ -118,12 +121,12 @@ class SecretBackendKeyArgs:
|
|
|
118
121
|
return pulumi.get(self, "allow_plaintext_backup")
|
|
119
122
|
|
|
120
123
|
@allow_plaintext_backup.setter
|
|
121
|
-
def allow_plaintext_backup(self, value: Optional[pulumi.Input[
|
|
124
|
+
def allow_plaintext_backup(self, value: Optional[pulumi.Input[_builtins.bool]]):
|
|
122
125
|
pulumi.set(self, "allow_plaintext_backup", value)
|
|
123
126
|
|
|
124
|
-
@property
|
|
127
|
+
@_builtins.property
|
|
125
128
|
@pulumi.getter(name="autoRotatePeriod")
|
|
126
|
-
def auto_rotate_period(self) -> Optional[pulumi.Input[
|
|
129
|
+
def auto_rotate_period(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
127
130
|
"""
|
|
128
131
|
Amount of seconds the key should live before being automatically rotated.
|
|
129
132
|
A value of 0 disables automatic rotation for the key.
|
|
@@ -131,60 +134,60 @@ class SecretBackendKeyArgs:
|
|
|
131
134
|
return pulumi.get(self, "auto_rotate_period")
|
|
132
135
|
|
|
133
136
|
@auto_rotate_period.setter
|
|
134
|
-
def auto_rotate_period(self, value: Optional[pulumi.Input[
|
|
137
|
+
def auto_rotate_period(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
135
138
|
pulumi.set(self, "auto_rotate_period", value)
|
|
136
139
|
|
|
137
|
-
@property
|
|
140
|
+
@_builtins.property
|
|
138
141
|
@pulumi.getter(name="convergentEncryption")
|
|
139
|
-
def convergent_encryption(self) -> Optional[pulumi.Input[
|
|
142
|
+
def convergent_encryption(self) -> Optional[pulumi.Input[_builtins.bool]]:
|
|
140
143
|
"""
|
|
141
144
|
Whether or not to support convergent encryption, where the same plaintext creates the same ciphertext. This requires `derived` to be set to `true`.
|
|
142
145
|
"""
|
|
143
146
|
return pulumi.get(self, "convergent_encryption")
|
|
144
147
|
|
|
145
148
|
@convergent_encryption.setter
|
|
146
|
-
def convergent_encryption(self, value: Optional[pulumi.Input[
|
|
149
|
+
def convergent_encryption(self, value: Optional[pulumi.Input[_builtins.bool]]):
|
|
147
150
|
pulumi.set(self, "convergent_encryption", value)
|
|
148
151
|
|
|
149
|
-
@property
|
|
152
|
+
@_builtins.property
|
|
150
153
|
@pulumi.getter(name="deletionAllowed")
|
|
151
|
-
def deletion_allowed(self) -> Optional[pulumi.Input[
|
|
154
|
+
def deletion_allowed(self) -> Optional[pulumi.Input[_builtins.bool]]:
|
|
152
155
|
"""
|
|
153
156
|
Specifies if the key is allowed to be deleted.
|
|
154
157
|
"""
|
|
155
158
|
return pulumi.get(self, "deletion_allowed")
|
|
156
159
|
|
|
157
160
|
@deletion_allowed.setter
|
|
158
|
-
def deletion_allowed(self, value: Optional[pulumi.Input[
|
|
161
|
+
def deletion_allowed(self, value: Optional[pulumi.Input[_builtins.bool]]):
|
|
159
162
|
pulumi.set(self, "deletion_allowed", value)
|
|
160
163
|
|
|
161
|
-
@property
|
|
164
|
+
@_builtins.property
|
|
162
165
|
@pulumi.getter
|
|
163
|
-
def derived(self) -> Optional[pulumi.Input[
|
|
166
|
+
def derived(self) -> Optional[pulumi.Input[_builtins.bool]]:
|
|
164
167
|
"""
|
|
165
168
|
Specifies if key derivation is to be used. If enabled, all encrypt/decrypt requests to this key must provide a context which is used for key derivation.
|
|
166
169
|
"""
|
|
167
170
|
return pulumi.get(self, "derived")
|
|
168
171
|
|
|
169
172
|
@derived.setter
|
|
170
|
-
def derived(self, value: Optional[pulumi.Input[
|
|
173
|
+
def derived(self, value: Optional[pulumi.Input[_builtins.bool]]):
|
|
171
174
|
pulumi.set(self, "derived", value)
|
|
172
175
|
|
|
173
|
-
@property
|
|
176
|
+
@_builtins.property
|
|
174
177
|
@pulumi.getter
|
|
175
|
-
def exportable(self) -> Optional[pulumi.Input[
|
|
178
|
+
def exportable(self) -> Optional[pulumi.Input[_builtins.bool]]:
|
|
176
179
|
"""
|
|
177
180
|
Enables keys to be exportable. This allows for all valid private keys in the keyring to be exported. Once set, this cannot be disabled.
|
|
178
181
|
"""
|
|
179
182
|
return pulumi.get(self, "exportable")
|
|
180
183
|
|
|
181
184
|
@exportable.setter
|
|
182
|
-
def exportable(self, value: Optional[pulumi.Input[
|
|
185
|
+
def exportable(self, value: Optional[pulumi.Input[_builtins.bool]]):
|
|
183
186
|
pulumi.set(self, "exportable", value)
|
|
184
187
|
|
|
185
|
-
@property
|
|
188
|
+
@_builtins.property
|
|
186
189
|
@pulumi.getter(name="hybridKeyTypeEc")
|
|
187
|
-
def hybrid_key_type_ec(self) -> Optional[pulumi.Input[
|
|
190
|
+
def hybrid_key_type_ec(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
188
191
|
"""
|
|
189
192
|
The elliptic curve algorithm to use for hybrid signatures.
|
|
190
193
|
Supported key types are `ecdsa-p256`, `ecdsa-p384`, `ecdsa-p521`, and `ed25519`.
|
|
@@ -192,12 +195,12 @@ class SecretBackendKeyArgs:
|
|
|
192
195
|
return pulumi.get(self, "hybrid_key_type_ec")
|
|
193
196
|
|
|
194
197
|
@hybrid_key_type_ec.setter
|
|
195
|
-
def hybrid_key_type_ec(self, value: Optional[pulumi.Input[
|
|
198
|
+
def hybrid_key_type_ec(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
196
199
|
pulumi.set(self, "hybrid_key_type_ec", value)
|
|
197
200
|
|
|
198
|
-
@property
|
|
201
|
+
@_builtins.property
|
|
199
202
|
@pulumi.getter(name="hybridKeyTypePqc")
|
|
200
|
-
def hybrid_key_type_pqc(self) -> Optional[pulumi.Input[
|
|
203
|
+
def hybrid_key_type_pqc(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
201
204
|
"""
|
|
202
205
|
The post-quantum algorithm to use for hybrid signatures.
|
|
203
206
|
Currently, ML-DSA is the only supported key type.
|
|
@@ -205,60 +208,60 @@ class SecretBackendKeyArgs:
|
|
|
205
208
|
return pulumi.get(self, "hybrid_key_type_pqc")
|
|
206
209
|
|
|
207
210
|
@hybrid_key_type_pqc.setter
|
|
208
|
-
def hybrid_key_type_pqc(self, value: Optional[pulumi.Input[
|
|
211
|
+
def hybrid_key_type_pqc(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
209
212
|
pulumi.set(self, "hybrid_key_type_pqc", value)
|
|
210
213
|
|
|
211
|
-
@property
|
|
214
|
+
@_builtins.property
|
|
212
215
|
@pulumi.getter(name="keySize")
|
|
213
|
-
def key_size(self) -> Optional[pulumi.Input[
|
|
216
|
+
def key_size(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
214
217
|
"""
|
|
215
218
|
The key size in bytes for algorithms that allow variable key sizes. Currently only applicable to HMAC, where it must be between 32 and 512 bytes.
|
|
216
219
|
"""
|
|
217
220
|
return pulumi.get(self, "key_size")
|
|
218
221
|
|
|
219
222
|
@key_size.setter
|
|
220
|
-
def key_size(self, value: Optional[pulumi.Input[
|
|
223
|
+
def key_size(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
221
224
|
pulumi.set(self, "key_size", value)
|
|
222
225
|
|
|
223
|
-
@property
|
|
226
|
+
@_builtins.property
|
|
224
227
|
@pulumi.getter(name="minDecryptionVersion")
|
|
225
|
-
def min_decryption_version(self) -> Optional[pulumi.Input[
|
|
228
|
+
def min_decryption_version(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
226
229
|
"""
|
|
227
230
|
Minimum key version to use for decryption.
|
|
228
231
|
"""
|
|
229
232
|
return pulumi.get(self, "min_decryption_version")
|
|
230
233
|
|
|
231
234
|
@min_decryption_version.setter
|
|
232
|
-
def min_decryption_version(self, value: Optional[pulumi.Input[
|
|
235
|
+
def min_decryption_version(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
233
236
|
pulumi.set(self, "min_decryption_version", value)
|
|
234
237
|
|
|
235
|
-
@property
|
|
238
|
+
@_builtins.property
|
|
236
239
|
@pulumi.getter(name="minEncryptionVersion")
|
|
237
|
-
def min_encryption_version(self) -> Optional[pulumi.Input[
|
|
240
|
+
def min_encryption_version(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
238
241
|
"""
|
|
239
242
|
Minimum key version to use for encryption
|
|
240
243
|
"""
|
|
241
244
|
return pulumi.get(self, "min_encryption_version")
|
|
242
245
|
|
|
243
246
|
@min_encryption_version.setter
|
|
244
|
-
def min_encryption_version(self, value: Optional[pulumi.Input[
|
|
247
|
+
def min_encryption_version(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
245
248
|
pulumi.set(self, "min_encryption_version", value)
|
|
246
249
|
|
|
247
|
-
@property
|
|
250
|
+
@_builtins.property
|
|
248
251
|
@pulumi.getter
|
|
249
|
-
def name(self) -> Optional[pulumi.Input[
|
|
252
|
+
def name(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
250
253
|
"""
|
|
251
254
|
The name to identify this key within the backend. Must be unique within the backend.
|
|
252
255
|
"""
|
|
253
256
|
return pulumi.get(self, "name")
|
|
254
257
|
|
|
255
258
|
@name.setter
|
|
256
|
-
def name(self, value: Optional[pulumi.Input[
|
|
259
|
+
def name(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
257
260
|
pulumi.set(self, "name", value)
|
|
258
261
|
|
|
259
|
-
@property
|
|
262
|
+
@_builtins.property
|
|
260
263
|
@pulumi.getter
|
|
261
|
-
def namespace(self) -> Optional[pulumi.Input[
|
|
264
|
+
def namespace(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
262
265
|
"""
|
|
263
266
|
The namespace to provision the resource in.
|
|
264
267
|
The value should not contain leading or trailing forward slashes.
|
|
@@ -268,97 +271,105 @@ class SecretBackendKeyArgs:
|
|
|
268
271
|
return pulumi.get(self, "namespace")
|
|
269
272
|
|
|
270
273
|
@namespace.setter
|
|
271
|
-
def namespace(self, value: Optional[pulumi.Input[
|
|
274
|
+
def namespace(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
272
275
|
pulumi.set(self, "namespace", value)
|
|
273
276
|
|
|
274
|
-
@property
|
|
277
|
+
@_builtins.property
|
|
275
278
|
@pulumi.getter(name="parameterSet")
|
|
276
|
-
def parameter_set(self) -> Optional[pulumi.Input[
|
|
279
|
+
def parameter_set(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
277
280
|
"""
|
|
278
|
-
The parameter set to use for ML-DSA. Required for
|
|
279
|
-
ML-DSA and
|
|
281
|
+
The parameter set to use for ML-DSA or SLH-DSA. Required for
|
|
282
|
+
ML-DSA, hybrid, and SLH-DSA keys.
|
|
283
|
+
Valid values for ML-DSA are `44`, `65`, and `87`.
|
|
284
|
+
Valid values for SLH-DSA are `slh-dsa-sha2-128s`, `slh-dsa-shake-128s`, `slh-dsa-sha2-128f`, `slh-dsa-shake-128`, `slh-dsa-sha2-192s`,
|
|
285
|
+
`slh-dsa-shake-192s`, `slh-dsa-sha2-192f`, `slh-dsa-shake-192f`, `slh-dsa-sha2-256s`, `slh-dsa-shake-256s`,
|
|
286
|
+
`slh-dsa-sha2-256f`, and `slh-dsa-shake-256f`.
|
|
280
287
|
"""
|
|
281
288
|
return pulumi.get(self, "parameter_set")
|
|
282
289
|
|
|
283
290
|
@parameter_set.setter
|
|
284
|
-
def parameter_set(self, value: Optional[pulumi.Input[
|
|
291
|
+
def parameter_set(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
285
292
|
pulumi.set(self, "parameter_set", value)
|
|
286
293
|
|
|
287
|
-
@property
|
|
294
|
+
@_builtins.property
|
|
288
295
|
@pulumi.getter
|
|
289
|
-
def type(self) -> Optional[pulumi.Input[
|
|
296
|
+
def type(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
290
297
|
"""
|
|
291
|
-
Specifies the type of key to create. The currently-supported types are: `aes128-gcm96`, `aes256-gcm96` (default), `chacha20-poly1305`, `ed25519`, `ecdsa-p256`, `ecdsa-p384`, `ecdsa-p521`, `hmac`, `rsa-2048`, `rsa-3072` and `
|
|
298
|
+
Specifies the type of key to create. The currently-supported types are: `aes128-gcm96`, `aes256-gcm96` (default), `chacha20-poly1305`, `ed25519`, `ecdsa-p256`, `ecdsa-p384`, `ecdsa-p521`, `hmac`, `rsa-2048`, `rsa-3072`, `rsa-4096`, `managed_key`, `aes128-cmac`, `aes192-cmac`, `aes256-cmac`, `ml-dsa`, `hybrid`, and `slh-dsa`.
|
|
292
299
|
* Refer to the Vault documentation on transit key types for more information: [Key Types](https://www.vaultproject.io/docs/secrets/transit#key-types)
|
|
293
300
|
"""
|
|
294
301
|
return pulumi.get(self, "type")
|
|
295
302
|
|
|
296
303
|
@type.setter
|
|
297
|
-
def type(self, value: Optional[pulumi.Input[
|
|
304
|
+
def type(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
298
305
|
pulumi.set(self, "type", value)
|
|
299
306
|
|
|
300
307
|
|
|
301
308
|
@pulumi.input_type
|
|
302
309
|
class _SecretBackendKeyState:
|
|
303
310
|
def __init__(__self__, *,
|
|
304
|
-
allow_plaintext_backup: Optional[pulumi.Input[
|
|
305
|
-
auto_rotate_period: Optional[pulumi.Input[
|
|
306
|
-
backend: Optional[pulumi.Input[
|
|
307
|
-
convergent_encryption: Optional[pulumi.Input[
|
|
308
|
-
deletion_allowed: Optional[pulumi.Input[
|
|
309
|
-
derived: Optional[pulumi.Input[
|
|
310
|
-
exportable: Optional[pulumi.Input[
|
|
311
|
-
hybrid_key_type_ec: Optional[pulumi.Input[
|
|
312
|
-
hybrid_key_type_pqc: Optional[pulumi.Input[
|
|
313
|
-
key_size: Optional[pulumi.Input[
|
|
314
|
-
keys: Optional[pulumi.Input[Sequence[pulumi.Input[Mapping[str, pulumi.Input[
|
|
315
|
-
latest_version: Optional[pulumi.Input[
|
|
316
|
-
min_available_version: Optional[pulumi.Input[
|
|
317
|
-
min_decryption_version: Optional[pulumi.Input[
|
|
318
|
-
min_encryption_version: Optional[pulumi.Input[
|
|
319
|
-
name: Optional[pulumi.Input[
|
|
320
|
-
namespace: Optional[pulumi.Input[
|
|
321
|
-
parameter_set: Optional[pulumi.Input[
|
|
322
|
-
supports_decryption: Optional[pulumi.Input[
|
|
323
|
-
supports_derivation: Optional[pulumi.Input[
|
|
324
|
-
supports_encryption: Optional[pulumi.Input[
|
|
325
|
-
supports_signing: Optional[pulumi.Input[
|
|
326
|
-
type: Optional[pulumi.Input[
|
|
311
|
+
allow_plaintext_backup: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
312
|
+
auto_rotate_period: Optional[pulumi.Input[_builtins.int]] = None,
|
|
313
|
+
backend: Optional[pulumi.Input[_builtins.str]] = None,
|
|
314
|
+
convergent_encryption: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
315
|
+
deletion_allowed: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
316
|
+
derived: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
317
|
+
exportable: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
318
|
+
hybrid_key_type_ec: Optional[pulumi.Input[_builtins.str]] = None,
|
|
319
|
+
hybrid_key_type_pqc: Optional[pulumi.Input[_builtins.str]] = None,
|
|
320
|
+
key_size: Optional[pulumi.Input[_builtins.int]] = None,
|
|
321
|
+
keys: Optional[pulumi.Input[Sequence[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]]]] = None,
|
|
322
|
+
latest_version: Optional[pulumi.Input[_builtins.int]] = None,
|
|
323
|
+
min_available_version: Optional[pulumi.Input[_builtins.int]] = None,
|
|
324
|
+
min_decryption_version: Optional[pulumi.Input[_builtins.int]] = None,
|
|
325
|
+
min_encryption_version: Optional[pulumi.Input[_builtins.int]] = None,
|
|
326
|
+
name: Optional[pulumi.Input[_builtins.str]] = None,
|
|
327
|
+
namespace: Optional[pulumi.Input[_builtins.str]] = None,
|
|
328
|
+
parameter_set: Optional[pulumi.Input[_builtins.str]] = None,
|
|
329
|
+
supports_decryption: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
330
|
+
supports_derivation: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
331
|
+
supports_encryption: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
332
|
+
supports_signing: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
333
|
+
type: Optional[pulumi.Input[_builtins.str]] = None):
|
|
327
334
|
"""
|
|
328
335
|
Input properties used for looking up and filtering SecretBackendKey resources.
|
|
329
|
-
:param pulumi.Input[
|
|
336
|
+
:param pulumi.Input[_builtins.bool] allow_plaintext_backup: Enables taking backup of entire keyring in the plaintext format. Once set, this cannot be disabled.
|
|
330
337
|
* Refer to Vault API documentation on key backups for more information: [Backup Key](https://www.vaultproject.io/api-docs/secret/transit#backup-key)
|
|
331
|
-
:param pulumi.Input[
|
|
338
|
+
:param pulumi.Input[_builtins.int] auto_rotate_period: Amount of seconds the key should live before being automatically rotated.
|
|
332
339
|
A value of 0 disables automatic rotation for the key.
|
|
333
|
-
:param pulumi.Input[
|
|
334
|
-
:param pulumi.Input[
|
|
335
|
-
:param pulumi.Input[
|
|
336
|
-
:param pulumi.Input[
|
|
337
|
-
:param pulumi.Input[
|
|
338
|
-
:param pulumi.Input[
|
|
340
|
+
:param pulumi.Input[_builtins.str] backend: The path the transit secret backend is mounted at, with no leading or trailing `/`s.
|
|
341
|
+
:param pulumi.Input[_builtins.bool] convergent_encryption: Whether or not to support convergent encryption, where the same plaintext creates the same ciphertext. This requires `derived` to be set to `true`.
|
|
342
|
+
:param pulumi.Input[_builtins.bool] deletion_allowed: Specifies if the key is allowed to be deleted.
|
|
343
|
+
:param pulumi.Input[_builtins.bool] derived: Specifies if key derivation is to be used. If enabled, all encrypt/decrypt requests to this key must provide a context which is used for key derivation.
|
|
344
|
+
:param pulumi.Input[_builtins.bool] exportable: Enables keys to be exportable. This allows for all valid private keys in the keyring to be exported. Once set, this cannot be disabled.
|
|
345
|
+
:param pulumi.Input[_builtins.str] hybrid_key_type_ec: The elliptic curve algorithm to use for hybrid signatures.
|
|
339
346
|
Supported key types are `ecdsa-p256`, `ecdsa-p384`, `ecdsa-p521`, and `ed25519`.
|
|
340
|
-
:param pulumi.Input[
|
|
347
|
+
:param pulumi.Input[_builtins.str] hybrid_key_type_pqc: The post-quantum algorithm to use for hybrid signatures.
|
|
341
348
|
Currently, ML-DSA is the only supported key type.
|
|
342
|
-
:param pulumi.Input[
|
|
343
|
-
:param pulumi.Input[Sequence[pulumi.Input[Mapping[str, pulumi.Input[
|
|
349
|
+
:param pulumi.Input[_builtins.int] key_size: The key size in bytes for algorithms that allow variable key sizes. Currently only applicable to HMAC, where it must be between 32 and 512 bytes.
|
|
350
|
+
:param pulumi.Input[Sequence[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]]] keys: List of key versions in the keyring. This attribute is zero-indexed and will contain a map of values depending on the `type` of the encryption key.
|
|
344
351
|
* for key types `aes128-gcm96`, `aes256-gcm96` and `chacha20-poly1305`, each key version will be a map of a single value `id` which is just a hash of the key's metadata.
|
|
345
352
|
* for key types `ed25519`, `ecdsa-p256`, `ecdsa-p384`, `ecdsa-p521`, `rsa-2048`, `rsa-3072` and `rsa-4096`, each key version will be a map of the following:
|
|
346
|
-
:param pulumi.Input[
|
|
347
|
-
:param pulumi.Input[
|
|
348
|
-
:param pulumi.Input[
|
|
349
|
-
:param pulumi.Input[
|
|
350
|
-
:param pulumi.Input[
|
|
351
|
-
:param pulumi.Input[
|
|
353
|
+
:param pulumi.Input[_builtins.int] latest_version: Latest key version available. This value is 1-indexed, so if `latest_version` is `1`, then the key's information can be referenced from `keys` by selecting element `0`
|
|
354
|
+
:param pulumi.Input[_builtins.int] min_available_version: Minimum key version available for use. If keys have been archived by increasing `min_decryption_version`, this attribute will reflect that change.
|
|
355
|
+
:param pulumi.Input[_builtins.int] min_decryption_version: Minimum key version to use for decryption.
|
|
356
|
+
:param pulumi.Input[_builtins.int] min_encryption_version: Minimum key version to use for encryption
|
|
357
|
+
:param pulumi.Input[_builtins.str] name: The name to identify this key within the backend. Must be unique within the backend.
|
|
358
|
+
:param pulumi.Input[_builtins.str] namespace: The namespace to provision the resource in.
|
|
352
359
|
The value should not contain leading or trailing forward slashes.
|
|
353
360
|
The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).
|
|
354
361
|
*Available only for Vault Enterprise*.
|
|
355
|
-
:param pulumi.Input[
|
|
356
|
-
ML-DSA and
|
|
357
|
-
|
|
358
|
-
|
|
359
|
-
|
|
360
|
-
|
|
361
|
-
:param pulumi.Input[
|
|
362
|
+
:param pulumi.Input[_builtins.str] parameter_set: The parameter set to use for ML-DSA or SLH-DSA. Required for
|
|
363
|
+
ML-DSA, hybrid, and SLH-DSA keys.
|
|
364
|
+
Valid values for ML-DSA are `44`, `65`, and `87`.
|
|
365
|
+
Valid values for SLH-DSA are `slh-dsa-sha2-128s`, `slh-dsa-shake-128s`, `slh-dsa-sha2-128f`, `slh-dsa-shake-128`, `slh-dsa-sha2-192s`,
|
|
366
|
+
`slh-dsa-shake-192s`, `slh-dsa-sha2-192f`, `slh-dsa-shake-192f`, `slh-dsa-sha2-256s`, `slh-dsa-shake-256s`,
|
|
367
|
+
`slh-dsa-sha2-256f`, and `slh-dsa-shake-256f`.
|
|
368
|
+
:param pulumi.Input[_builtins.bool] supports_decryption: Whether or not the key supports decryption, based on key type.
|
|
369
|
+
:param pulumi.Input[_builtins.bool] supports_derivation: Whether or not the key supports derivation, based on key type.
|
|
370
|
+
:param pulumi.Input[_builtins.bool] supports_encryption: Whether or not the key supports encryption, based on key type.
|
|
371
|
+
:param pulumi.Input[_builtins.bool] supports_signing: Whether or not the key supports signing, based on key type.
|
|
372
|
+
:param pulumi.Input[_builtins.str] type: Specifies the type of key to create. The currently-supported types are: `aes128-gcm96`, `aes256-gcm96` (default), `chacha20-poly1305`, `ed25519`, `ecdsa-p256`, `ecdsa-p384`, `ecdsa-p521`, `hmac`, `rsa-2048`, `rsa-3072`, `rsa-4096`, `managed_key`, `aes128-cmac`, `aes192-cmac`, `aes256-cmac`, `ml-dsa`, `hybrid`, and `slh-dsa`.
|
|
362
373
|
* Refer to the Vault documentation on transit key types for more information: [Key Types](https://www.vaultproject.io/docs/secrets/transit#key-types)
|
|
363
374
|
"""
|
|
364
375
|
if allow_plaintext_backup is not None:
|
|
@@ -408,9 +419,9 @@ class _SecretBackendKeyState:
|
|
|
408
419
|
if type is not None:
|
|
409
420
|
pulumi.set(__self__, "type", type)
|
|
410
421
|
|
|
411
|
-
@property
|
|
422
|
+
@_builtins.property
|
|
412
423
|
@pulumi.getter(name="allowPlaintextBackup")
|
|
413
|
-
def allow_plaintext_backup(self) -> Optional[pulumi.Input[
|
|
424
|
+
def allow_plaintext_backup(self) -> Optional[pulumi.Input[_builtins.bool]]:
|
|
414
425
|
"""
|
|
415
426
|
Enables taking backup of entire keyring in the plaintext format. Once set, this cannot be disabled.
|
|
416
427
|
* Refer to Vault API documentation on key backups for more information: [Backup Key](https://www.vaultproject.io/api-docs/secret/transit#backup-key)
|
|
@@ -418,12 +429,12 @@ class _SecretBackendKeyState:
|
|
|
418
429
|
return pulumi.get(self, "allow_plaintext_backup")
|
|
419
430
|
|
|
420
431
|
@allow_plaintext_backup.setter
|
|
421
|
-
def allow_plaintext_backup(self, value: Optional[pulumi.Input[
|
|
432
|
+
def allow_plaintext_backup(self, value: Optional[pulumi.Input[_builtins.bool]]):
|
|
422
433
|
pulumi.set(self, "allow_plaintext_backup", value)
|
|
423
434
|
|
|
424
|
-
@property
|
|
435
|
+
@_builtins.property
|
|
425
436
|
@pulumi.getter(name="autoRotatePeriod")
|
|
426
|
-
def auto_rotate_period(self) -> Optional[pulumi.Input[
|
|
437
|
+
def auto_rotate_period(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
427
438
|
"""
|
|
428
439
|
Amount of seconds the key should live before being automatically rotated.
|
|
429
440
|
A value of 0 disables automatic rotation for the key.
|
|
@@ -431,72 +442,72 @@ class _SecretBackendKeyState:
|
|
|
431
442
|
return pulumi.get(self, "auto_rotate_period")
|
|
432
443
|
|
|
433
444
|
@auto_rotate_period.setter
|
|
434
|
-
def auto_rotate_period(self, value: Optional[pulumi.Input[
|
|
445
|
+
def auto_rotate_period(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
435
446
|
pulumi.set(self, "auto_rotate_period", value)
|
|
436
447
|
|
|
437
|
-
@property
|
|
448
|
+
@_builtins.property
|
|
438
449
|
@pulumi.getter
|
|
439
|
-
def backend(self) -> Optional[pulumi.Input[
|
|
450
|
+
def backend(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
440
451
|
"""
|
|
441
452
|
The path the transit secret backend is mounted at, with no leading or trailing `/`s.
|
|
442
453
|
"""
|
|
443
454
|
return pulumi.get(self, "backend")
|
|
444
455
|
|
|
445
456
|
@backend.setter
|
|
446
|
-
def backend(self, value: Optional[pulumi.Input[
|
|
457
|
+
def backend(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
447
458
|
pulumi.set(self, "backend", value)
|
|
448
459
|
|
|
449
|
-
@property
|
|
460
|
+
@_builtins.property
|
|
450
461
|
@pulumi.getter(name="convergentEncryption")
|
|
451
|
-
def convergent_encryption(self) -> Optional[pulumi.Input[
|
|
462
|
+
def convergent_encryption(self) -> Optional[pulumi.Input[_builtins.bool]]:
|
|
452
463
|
"""
|
|
453
464
|
Whether or not to support convergent encryption, where the same plaintext creates the same ciphertext. This requires `derived` to be set to `true`.
|
|
454
465
|
"""
|
|
455
466
|
return pulumi.get(self, "convergent_encryption")
|
|
456
467
|
|
|
457
468
|
@convergent_encryption.setter
|
|
458
|
-
def convergent_encryption(self, value: Optional[pulumi.Input[
|
|
469
|
+
def convergent_encryption(self, value: Optional[pulumi.Input[_builtins.bool]]):
|
|
459
470
|
pulumi.set(self, "convergent_encryption", value)
|
|
460
471
|
|
|
461
|
-
@property
|
|
472
|
+
@_builtins.property
|
|
462
473
|
@pulumi.getter(name="deletionAllowed")
|
|
463
|
-
def deletion_allowed(self) -> Optional[pulumi.Input[
|
|
474
|
+
def deletion_allowed(self) -> Optional[pulumi.Input[_builtins.bool]]:
|
|
464
475
|
"""
|
|
465
476
|
Specifies if the key is allowed to be deleted.
|
|
466
477
|
"""
|
|
467
478
|
return pulumi.get(self, "deletion_allowed")
|
|
468
479
|
|
|
469
480
|
@deletion_allowed.setter
|
|
470
|
-
def deletion_allowed(self, value: Optional[pulumi.Input[
|
|
481
|
+
def deletion_allowed(self, value: Optional[pulumi.Input[_builtins.bool]]):
|
|
471
482
|
pulumi.set(self, "deletion_allowed", value)
|
|
472
483
|
|
|
473
|
-
@property
|
|
484
|
+
@_builtins.property
|
|
474
485
|
@pulumi.getter
|
|
475
|
-
def derived(self) -> Optional[pulumi.Input[
|
|
486
|
+
def derived(self) -> Optional[pulumi.Input[_builtins.bool]]:
|
|
476
487
|
"""
|
|
477
488
|
Specifies if key derivation is to be used. If enabled, all encrypt/decrypt requests to this key must provide a context which is used for key derivation.
|
|
478
489
|
"""
|
|
479
490
|
return pulumi.get(self, "derived")
|
|
480
491
|
|
|
481
492
|
@derived.setter
|
|
482
|
-
def derived(self, value: Optional[pulumi.Input[
|
|
493
|
+
def derived(self, value: Optional[pulumi.Input[_builtins.bool]]):
|
|
483
494
|
pulumi.set(self, "derived", value)
|
|
484
495
|
|
|
485
|
-
@property
|
|
496
|
+
@_builtins.property
|
|
486
497
|
@pulumi.getter
|
|
487
|
-
def exportable(self) -> Optional[pulumi.Input[
|
|
498
|
+
def exportable(self) -> Optional[pulumi.Input[_builtins.bool]]:
|
|
488
499
|
"""
|
|
489
500
|
Enables keys to be exportable. This allows for all valid private keys in the keyring to be exported. Once set, this cannot be disabled.
|
|
490
501
|
"""
|
|
491
502
|
return pulumi.get(self, "exportable")
|
|
492
503
|
|
|
493
504
|
@exportable.setter
|
|
494
|
-
def exportable(self, value: Optional[pulumi.Input[
|
|
505
|
+
def exportable(self, value: Optional[pulumi.Input[_builtins.bool]]):
|
|
495
506
|
pulumi.set(self, "exportable", value)
|
|
496
507
|
|
|
497
|
-
@property
|
|
508
|
+
@_builtins.property
|
|
498
509
|
@pulumi.getter(name="hybridKeyTypeEc")
|
|
499
|
-
def hybrid_key_type_ec(self) -> Optional[pulumi.Input[
|
|
510
|
+
def hybrid_key_type_ec(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
500
511
|
"""
|
|
501
512
|
The elliptic curve algorithm to use for hybrid signatures.
|
|
502
513
|
Supported key types are `ecdsa-p256`, `ecdsa-p384`, `ecdsa-p521`, and `ed25519`.
|
|
@@ -504,12 +515,12 @@ class _SecretBackendKeyState:
|
|
|
504
515
|
return pulumi.get(self, "hybrid_key_type_ec")
|
|
505
516
|
|
|
506
517
|
@hybrid_key_type_ec.setter
|
|
507
|
-
def hybrid_key_type_ec(self, value: Optional[pulumi.Input[
|
|
518
|
+
def hybrid_key_type_ec(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
508
519
|
pulumi.set(self, "hybrid_key_type_ec", value)
|
|
509
520
|
|
|
510
|
-
@property
|
|
521
|
+
@_builtins.property
|
|
511
522
|
@pulumi.getter(name="hybridKeyTypePqc")
|
|
512
|
-
def hybrid_key_type_pqc(self) -> Optional[pulumi.Input[
|
|
523
|
+
def hybrid_key_type_pqc(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
513
524
|
"""
|
|
514
525
|
The post-quantum algorithm to use for hybrid signatures.
|
|
515
526
|
Currently, ML-DSA is the only supported key type.
|
|
@@ -517,24 +528,24 @@ class _SecretBackendKeyState:
|
|
|
517
528
|
return pulumi.get(self, "hybrid_key_type_pqc")
|
|
518
529
|
|
|
519
530
|
@hybrid_key_type_pqc.setter
|
|
520
|
-
def hybrid_key_type_pqc(self, value: Optional[pulumi.Input[
|
|
531
|
+
def hybrid_key_type_pqc(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
521
532
|
pulumi.set(self, "hybrid_key_type_pqc", value)
|
|
522
533
|
|
|
523
|
-
@property
|
|
534
|
+
@_builtins.property
|
|
524
535
|
@pulumi.getter(name="keySize")
|
|
525
|
-
def key_size(self) -> Optional[pulumi.Input[
|
|
536
|
+
def key_size(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
526
537
|
"""
|
|
527
538
|
The key size in bytes for algorithms that allow variable key sizes. Currently only applicable to HMAC, where it must be between 32 and 512 bytes.
|
|
528
539
|
"""
|
|
529
540
|
return pulumi.get(self, "key_size")
|
|
530
541
|
|
|
531
542
|
@key_size.setter
|
|
532
|
-
def key_size(self, value: Optional[pulumi.Input[
|
|
543
|
+
def key_size(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
533
544
|
pulumi.set(self, "key_size", value)
|
|
534
545
|
|
|
535
|
-
@property
|
|
546
|
+
@_builtins.property
|
|
536
547
|
@pulumi.getter
|
|
537
|
-
def keys(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[Mapping[str, pulumi.Input[
|
|
548
|
+
def keys(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]]]]:
|
|
538
549
|
"""
|
|
539
550
|
List of key versions in the keyring. This attribute is zero-indexed and will contain a map of values depending on the `type` of the encryption key.
|
|
540
551
|
* for key types `aes128-gcm96`, `aes256-gcm96` and `chacha20-poly1305`, each key version will be a map of a single value `id` which is just a hash of the key's metadata.
|
|
@@ -543,72 +554,72 @@ class _SecretBackendKeyState:
|
|
|
543
554
|
return pulumi.get(self, "keys")
|
|
544
555
|
|
|
545
556
|
@keys.setter
|
|
546
|
-
def keys(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[Mapping[str, pulumi.Input[
|
|
557
|
+
def keys(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]]]]):
|
|
547
558
|
pulumi.set(self, "keys", value)
|
|
548
559
|
|
|
549
|
-
@property
|
|
560
|
+
@_builtins.property
|
|
550
561
|
@pulumi.getter(name="latestVersion")
|
|
551
|
-
def latest_version(self) -> Optional[pulumi.Input[
|
|
562
|
+
def latest_version(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
552
563
|
"""
|
|
553
564
|
Latest key version available. This value is 1-indexed, so if `latest_version` is `1`, then the key's information can be referenced from `keys` by selecting element `0`
|
|
554
565
|
"""
|
|
555
566
|
return pulumi.get(self, "latest_version")
|
|
556
567
|
|
|
557
568
|
@latest_version.setter
|
|
558
|
-
def latest_version(self, value: Optional[pulumi.Input[
|
|
569
|
+
def latest_version(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
559
570
|
pulumi.set(self, "latest_version", value)
|
|
560
571
|
|
|
561
|
-
@property
|
|
572
|
+
@_builtins.property
|
|
562
573
|
@pulumi.getter(name="minAvailableVersion")
|
|
563
|
-
def min_available_version(self) -> Optional[pulumi.Input[
|
|
574
|
+
def min_available_version(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
564
575
|
"""
|
|
565
576
|
Minimum key version available for use. If keys have been archived by increasing `min_decryption_version`, this attribute will reflect that change.
|
|
566
577
|
"""
|
|
567
578
|
return pulumi.get(self, "min_available_version")
|
|
568
579
|
|
|
569
580
|
@min_available_version.setter
|
|
570
|
-
def min_available_version(self, value: Optional[pulumi.Input[
|
|
581
|
+
def min_available_version(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
571
582
|
pulumi.set(self, "min_available_version", value)
|
|
572
583
|
|
|
573
|
-
@property
|
|
584
|
+
@_builtins.property
|
|
574
585
|
@pulumi.getter(name="minDecryptionVersion")
|
|
575
|
-
def min_decryption_version(self) -> Optional[pulumi.Input[
|
|
586
|
+
def min_decryption_version(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
576
587
|
"""
|
|
577
588
|
Minimum key version to use for decryption.
|
|
578
589
|
"""
|
|
579
590
|
return pulumi.get(self, "min_decryption_version")
|
|
580
591
|
|
|
581
592
|
@min_decryption_version.setter
|
|
582
|
-
def min_decryption_version(self, value: Optional[pulumi.Input[
|
|
593
|
+
def min_decryption_version(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
583
594
|
pulumi.set(self, "min_decryption_version", value)
|
|
584
595
|
|
|
585
|
-
@property
|
|
596
|
+
@_builtins.property
|
|
586
597
|
@pulumi.getter(name="minEncryptionVersion")
|
|
587
|
-
def min_encryption_version(self) -> Optional[pulumi.Input[
|
|
598
|
+
def min_encryption_version(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
588
599
|
"""
|
|
589
600
|
Minimum key version to use for encryption
|
|
590
601
|
"""
|
|
591
602
|
return pulumi.get(self, "min_encryption_version")
|
|
592
603
|
|
|
593
604
|
@min_encryption_version.setter
|
|
594
|
-
def min_encryption_version(self, value: Optional[pulumi.Input[
|
|
605
|
+
def min_encryption_version(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
595
606
|
pulumi.set(self, "min_encryption_version", value)
|
|
596
607
|
|
|
597
|
-
@property
|
|
608
|
+
@_builtins.property
|
|
598
609
|
@pulumi.getter
|
|
599
|
-
def name(self) -> Optional[pulumi.Input[
|
|
610
|
+
def name(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
600
611
|
"""
|
|
601
612
|
The name to identify this key within the backend. Must be unique within the backend.
|
|
602
613
|
"""
|
|
603
614
|
return pulumi.get(self, "name")
|
|
604
615
|
|
|
605
616
|
@name.setter
|
|
606
|
-
def name(self, value: Optional[pulumi.Input[
|
|
617
|
+
def name(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
607
618
|
pulumi.set(self, "name", value)
|
|
608
619
|
|
|
609
|
-
@property
|
|
620
|
+
@_builtins.property
|
|
610
621
|
@pulumi.getter
|
|
611
|
-
def namespace(self) -> Optional[pulumi.Input[
|
|
622
|
+
def namespace(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
612
623
|
"""
|
|
613
624
|
The namespace to provision the resource in.
|
|
614
625
|
The value should not contain leading or trailing forward slashes.
|
|
@@ -618,81 +629,85 @@ class _SecretBackendKeyState:
|
|
|
618
629
|
return pulumi.get(self, "namespace")
|
|
619
630
|
|
|
620
631
|
@namespace.setter
|
|
621
|
-
def namespace(self, value: Optional[pulumi.Input[
|
|
632
|
+
def namespace(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
622
633
|
pulumi.set(self, "namespace", value)
|
|
623
634
|
|
|
624
|
-
@property
|
|
635
|
+
@_builtins.property
|
|
625
636
|
@pulumi.getter(name="parameterSet")
|
|
626
|
-
def parameter_set(self) -> Optional[pulumi.Input[
|
|
637
|
+
def parameter_set(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
627
638
|
"""
|
|
628
|
-
The parameter set to use for ML-DSA. Required for
|
|
629
|
-
ML-DSA and
|
|
639
|
+
The parameter set to use for ML-DSA or SLH-DSA. Required for
|
|
640
|
+
ML-DSA, hybrid, and SLH-DSA keys.
|
|
641
|
+
Valid values for ML-DSA are `44`, `65`, and `87`.
|
|
642
|
+
Valid values for SLH-DSA are `slh-dsa-sha2-128s`, `slh-dsa-shake-128s`, `slh-dsa-sha2-128f`, `slh-dsa-shake-128`, `slh-dsa-sha2-192s`,
|
|
643
|
+
`slh-dsa-shake-192s`, `slh-dsa-sha2-192f`, `slh-dsa-shake-192f`, `slh-dsa-sha2-256s`, `slh-dsa-shake-256s`,
|
|
644
|
+
`slh-dsa-sha2-256f`, and `slh-dsa-shake-256f`.
|
|
630
645
|
"""
|
|
631
646
|
return pulumi.get(self, "parameter_set")
|
|
632
647
|
|
|
633
648
|
@parameter_set.setter
|
|
634
|
-
def parameter_set(self, value: Optional[pulumi.Input[
|
|
649
|
+
def parameter_set(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
635
650
|
pulumi.set(self, "parameter_set", value)
|
|
636
651
|
|
|
637
|
-
@property
|
|
652
|
+
@_builtins.property
|
|
638
653
|
@pulumi.getter(name="supportsDecryption")
|
|
639
|
-
def supports_decryption(self) -> Optional[pulumi.Input[
|
|
654
|
+
def supports_decryption(self) -> Optional[pulumi.Input[_builtins.bool]]:
|
|
640
655
|
"""
|
|
641
656
|
Whether or not the key supports decryption, based on key type.
|
|
642
657
|
"""
|
|
643
658
|
return pulumi.get(self, "supports_decryption")
|
|
644
659
|
|
|
645
660
|
@supports_decryption.setter
|
|
646
|
-
def supports_decryption(self, value: Optional[pulumi.Input[
|
|
661
|
+
def supports_decryption(self, value: Optional[pulumi.Input[_builtins.bool]]):
|
|
647
662
|
pulumi.set(self, "supports_decryption", value)
|
|
648
663
|
|
|
649
|
-
@property
|
|
664
|
+
@_builtins.property
|
|
650
665
|
@pulumi.getter(name="supportsDerivation")
|
|
651
|
-
def supports_derivation(self) -> Optional[pulumi.Input[
|
|
666
|
+
def supports_derivation(self) -> Optional[pulumi.Input[_builtins.bool]]:
|
|
652
667
|
"""
|
|
653
668
|
Whether or not the key supports derivation, based on key type.
|
|
654
669
|
"""
|
|
655
670
|
return pulumi.get(self, "supports_derivation")
|
|
656
671
|
|
|
657
672
|
@supports_derivation.setter
|
|
658
|
-
def supports_derivation(self, value: Optional[pulumi.Input[
|
|
673
|
+
def supports_derivation(self, value: Optional[pulumi.Input[_builtins.bool]]):
|
|
659
674
|
pulumi.set(self, "supports_derivation", value)
|
|
660
675
|
|
|
661
|
-
@property
|
|
676
|
+
@_builtins.property
|
|
662
677
|
@pulumi.getter(name="supportsEncryption")
|
|
663
|
-
def supports_encryption(self) -> Optional[pulumi.Input[
|
|
678
|
+
def supports_encryption(self) -> Optional[pulumi.Input[_builtins.bool]]:
|
|
664
679
|
"""
|
|
665
680
|
Whether or not the key supports encryption, based on key type.
|
|
666
681
|
"""
|
|
667
682
|
return pulumi.get(self, "supports_encryption")
|
|
668
683
|
|
|
669
684
|
@supports_encryption.setter
|
|
670
|
-
def supports_encryption(self, value: Optional[pulumi.Input[
|
|
685
|
+
def supports_encryption(self, value: Optional[pulumi.Input[_builtins.bool]]):
|
|
671
686
|
pulumi.set(self, "supports_encryption", value)
|
|
672
687
|
|
|
673
|
-
@property
|
|
688
|
+
@_builtins.property
|
|
674
689
|
@pulumi.getter(name="supportsSigning")
|
|
675
|
-
def supports_signing(self) -> Optional[pulumi.Input[
|
|
690
|
+
def supports_signing(self) -> Optional[pulumi.Input[_builtins.bool]]:
|
|
676
691
|
"""
|
|
677
692
|
Whether or not the key supports signing, based on key type.
|
|
678
693
|
"""
|
|
679
694
|
return pulumi.get(self, "supports_signing")
|
|
680
695
|
|
|
681
696
|
@supports_signing.setter
|
|
682
|
-
def supports_signing(self, value: Optional[pulumi.Input[
|
|
697
|
+
def supports_signing(self, value: Optional[pulumi.Input[_builtins.bool]]):
|
|
683
698
|
pulumi.set(self, "supports_signing", value)
|
|
684
699
|
|
|
685
|
-
@property
|
|
700
|
+
@_builtins.property
|
|
686
701
|
@pulumi.getter
|
|
687
|
-
def type(self) -> Optional[pulumi.Input[
|
|
702
|
+
def type(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
688
703
|
"""
|
|
689
|
-
Specifies the type of key to create. The currently-supported types are: `aes128-gcm96`, `aes256-gcm96` (default), `chacha20-poly1305`, `ed25519`, `ecdsa-p256`, `ecdsa-p384`, `ecdsa-p521`, `hmac`, `rsa-2048`, `rsa-3072` and `
|
|
704
|
+
Specifies the type of key to create. The currently-supported types are: `aes128-gcm96`, `aes256-gcm96` (default), `chacha20-poly1305`, `ed25519`, `ecdsa-p256`, `ecdsa-p384`, `ecdsa-p521`, `hmac`, `rsa-2048`, `rsa-3072`, `rsa-4096`, `managed_key`, `aes128-cmac`, `aes192-cmac`, `aes256-cmac`, `ml-dsa`, `hybrid`, and `slh-dsa`.
|
|
690
705
|
* Refer to the Vault documentation on transit key types for more information: [Key Types](https://www.vaultproject.io/docs/secrets/transit#key-types)
|
|
691
706
|
"""
|
|
692
707
|
return pulumi.get(self, "type")
|
|
693
708
|
|
|
694
709
|
@type.setter
|
|
695
|
-
def type(self, value: Optional[pulumi.Input[
|
|
710
|
+
def type(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
696
711
|
pulumi.set(self, "type", value)
|
|
697
712
|
|
|
698
713
|
|
|
@@ -702,22 +717,22 @@ class SecretBackendKey(pulumi.CustomResource):
|
|
|
702
717
|
def __init__(__self__,
|
|
703
718
|
resource_name: str,
|
|
704
719
|
opts: Optional[pulumi.ResourceOptions] = None,
|
|
705
|
-
allow_plaintext_backup: Optional[pulumi.Input[
|
|
706
|
-
auto_rotate_period: Optional[pulumi.Input[
|
|
707
|
-
backend: Optional[pulumi.Input[
|
|
708
|
-
convergent_encryption: Optional[pulumi.Input[
|
|
709
|
-
deletion_allowed: Optional[pulumi.Input[
|
|
710
|
-
derived: Optional[pulumi.Input[
|
|
711
|
-
exportable: Optional[pulumi.Input[
|
|
712
|
-
hybrid_key_type_ec: Optional[pulumi.Input[
|
|
713
|
-
hybrid_key_type_pqc: Optional[pulumi.Input[
|
|
714
|
-
key_size: Optional[pulumi.Input[
|
|
715
|
-
min_decryption_version: Optional[pulumi.Input[
|
|
716
|
-
min_encryption_version: Optional[pulumi.Input[
|
|
717
|
-
name: Optional[pulumi.Input[
|
|
718
|
-
namespace: Optional[pulumi.Input[
|
|
719
|
-
parameter_set: Optional[pulumi.Input[
|
|
720
|
-
type: Optional[pulumi.Input[
|
|
720
|
+
allow_plaintext_backup: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
721
|
+
auto_rotate_period: Optional[pulumi.Input[_builtins.int]] = None,
|
|
722
|
+
backend: Optional[pulumi.Input[_builtins.str]] = None,
|
|
723
|
+
convergent_encryption: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
724
|
+
deletion_allowed: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
725
|
+
derived: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
726
|
+
exportable: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
727
|
+
hybrid_key_type_ec: Optional[pulumi.Input[_builtins.str]] = None,
|
|
728
|
+
hybrid_key_type_pqc: Optional[pulumi.Input[_builtins.str]] = None,
|
|
729
|
+
key_size: Optional[pulumi.Input[_builtins.int]] = None,
|
|
730
|
+
min_decryption_version: Optional[pulumi.Input[_builtins.int]] = None,
|
|
731
|
+
min_encryption_version: Optional[pulumi.Input[_builtins.int]] = None,
|
|
732
|
+
name: Optional[pulumi.Input[_builtins.str]] = None,
|
|
733
|
+
namespace: Optional[pulumi.Input[_builtins.str]] = None,
|
|
734
|
+
parameter_set: Optional[pulumi.Input[_builtins.str]] = None,
|
|
735
|
+
type: Optional[pulumi.Input[_builtins.str]] = None,
|
|
721
736
|
__props__=None):
|
|
722
737
|
"""
|
|
723
738
|
Creates an Encryption Keyring on a Transit Secret Backend for Vault.
|
|
@@ -749,30 +764,34 @@ class SecretBackendKey(pulumi.CustomResource):
|
|
|
749
764
|
|
|
750
765
|
:param str resource_name: The name of the resource.
|
|
751
766
|
:param pulumi.ResourceOptions opts: Options for the resource.
|
|
752
|
-
:param pulumi.Input[
|
|
767
|
+
:param pulumi.Input[_builtins.bool] allow_plaintext_backup: Enables taking backup of entire keyring in the plaintext format. Once set, this cannot be disabled.
|
|
753
768
|
* Refer to Vault API documentation on key backups for more information: [Backup Key](https://www.vaultproject.io/api-docs/secret/transit#backup-key)
|
|
754
|
-
:param pulumi.Input[
|
|
769
|
+
:param pulumi.Input[_builtins.int] auto_rotate_period: Amount of seconds the key should live before being automatically rotated.
|
|
755
770
|
A value of 0 disables automatic rotation for the key.
|
|
756
|
-
:param pulumi.Input[
|
|
757
|
-
:param pulumi.Input[
|
|
758
|
-
:param pulumi.Input[
|
|
759
|
-
:param pulumi.Input[
|
|
760
|
-
:param pulumi.Input[
|
|
761
|
-
:param pulumi.Input[
|
|
771
|
+
:param pulumi.Input[_builtins.str] backend: The path the transit secret backend is mounted at, with no leading or trailing `/`s.
|
|
772
|
+
:param pulumi.Input[_builtins.bool] convergent_encryption: Whether or not to support convergent encryption, where the same plaintext creates the same ciphertext. This requires `derived` to be set to `true`.
|
|
773
|
+
:param pulumi.Input[_builtins.bool] deletion_allowed: Specifies if the key is allowed to be deleted.
|
|
774
|
+
:param pulumi.Input[_builtins.bool] derived: Specifies if key derivation is to be used. If enabled, all encrypt/decrypt requests to this key must provide a context which is used for key derivation.
|
|
775
|
+
:param pulumi.Input[_builtins.bool] exportable: Enables keys to be exportable. This allows for all valid private keys in the keyring to be exported. Once set, this cannot be disabled.
|
|
776
|
+
:param pulumi.Input[_builtins.str] hybrid_key_type_ec: The elliptic curve algorithm to use for hybrid signatures.
|
|
762
777
|
Supported key types are `ecdsa-p256`, `ecdsa-p384`, `ecdsa-p521`, and `ed25519`.
|
|
763
|
-
:param pulumi.Input[
|
|
778
|
+
:param pulumi.Input[_builtins.str] hybrid_key_type_pqc: The post-quantum algorithm to use for hybrid signatures.
|
|
764
779
|
Currently, ML-DSA is the only supported key type.
|
|
765
|
-
:param pulumi.Input[
|
|
766
|
-
:param pulumi.Input[
|
|
767
|
-
:param pulumi.Input[
|
|
768
|
-
:param pulumi.Input[
|
|
769
|
-
:param pulumi.Input[
|
|
780
|
+
:param pulumi.Input[_builtins.int] key_size: The key size in bytes for algorithms that allow variable key sizes. Currently only applicable to HMAC, where it must be between 32 and 512 bytes.
|
|
781
|
+
:param pulumi.Input[_builtins.int] min_decryption_version: Minimum key version to use for decryption.
|
|
782
|
+
:param pulumi.Input[_builtins.int] min_encryption_version: Minimum key version to use for encryption
|
|
783
|
+
:param pulumi.Input[_builtins.str] name: The name to identify this key within the backend. Must be unique within the backend.
|
|
784
|
+
:param pulumi.Input[_builtins.str] namespace: The namespace to provision the resource in.
|
|
770
785
|
The value should not contain leading or trailing forward slashes.
|
|
771
786
|
The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).
|
|
772
787
|
*Available only for Vault Enterprise*.
|
|
773
|
-
:param pulumi.Input[
|
|
774
|
-
ML-DSA and
|
|
775
|
-
|
|
788
|
+
:param pulumi.Input[_builtins.str] parameter_set: The parameter set to use for ML-DSA or SLH-DSA. Required for
|
|
789
|
+
ML-DSA, hybrid, and SLH-DSA keys.
|
|
790
|
+
Valid values for ML-DSA are `44`, `65`, and `87`.
|
|
791
|
+
Valid values for SLH-DSA are `slh-dsa-sha2-128s`, `slh-dsa-shake-128s`, `slh-dsa-sha2-128f`, `slh-dsa-shake-128`, `slh-dsa-sha2-192s`,
|
|
792
|
+
`slh-dsa-shake-192s`, `slh-dsa-sha2-192f`, `slh-dsa-shake-192f`, `slh-dsa-sha2-256s`, `slh-dsa-shake-256s`,
|
|
793
|
+
`slh-dsa-sha2-256f`, and `slh-dsa-shake-256f`.
|
|
794
|
+
:param pulumi.Input[_builtins.str] type: Specifies the type of key to create. The currently-supported types are: `aes128-gcm96`, `aes256-gcm96` (default), `chacha20-poly1305`, `ed25519`, `ecdsa-p256`, `ecdsa-p384`, `ecdsa-p521`, `hmac`, `rsa-2048`, `rsa-3072`, `rsa-4096`, `managed_key`, `aes128-cmac`, `aes192-cmac`, `aes256-cmac`, `ml-dsa`, `hybrid`, and `slh-dsa`.
|
|
776
795
|
* Refer to the Vault documentation on transit key types for more information: [Key Types](https://www.vaultproject.io/docs/secrets/transit#key-types)
|
|
777
796
|
"""
|
|
778
797
|
...
|
|
@@ -824,22 +843,22 @@ class SecretBackendKey(pulumi.CustomResource):
|
|
|
824
843
|
def _internal_init(__self__,
|
|
825
844
|
resource_name: str,
|
|
826
845
|
opts: Optional[pulumi.ResourceOptions] = None,
|
|
827
|
-
allow_plaintext_backup: Optional[pulumi.Input[
|
|
828
|
-
auto_rotate_period: Optional[pulumi.Input[
|
|
829
|
-
backend: Optional[pulumi.Input[
|
|
830
|
-
convergent_encryption: Optional[pulumi.Input[
|
|
831
|
-
deletion_allowed: Optional[pulumi.Input[
|
|
832
|
-
derived: Optional[pulumi.Input[
|
|
833
|
-
exportable: Optional[pulumi.Input[
|
|
834
|
-
hybrid_key_type_ec: Optional[pulumi.Input[
|
|
835
|
-
hybrid_key_type_pqc: Optional[pulumi.Input[
|
|
836
|
-
key_size: Optional[pulumi.Input[
|
|
837
|
-
min_decryption_version: Optional[pulumi.Input[
|
|
838
|
-
min_encryption_version: Optional[pulumi.Input[
|
|
839
|
-
name: Optional[pulumi.Input[
|
|
840
|
-
namespace: Optional[pulumi.Input[
|
|
841
|
-
parameter_set: Optional[pulumi.Input[
|
|
842
|
-
type: Optional[pulumi.Input[
|
|
846
|
+
allow_plaintext_backup: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
847
|
+
auto_rotate_period: Optional[pulumi.Input[_builtins.int]] = None,
|
|
848
|
+
backend: Optional[pulumi.Input[_builtins.str]] = None,
|
|
849
|
+
convergent_encryption: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
850
|
+
deletion_allowed: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
851
|
+
derived: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
852
|
+
exportable: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
853
|
+
hybrid_key_type_ec: Optional[pulumi.Input[_builtins.str]] = None,
|
|
854
|
+
hybrid_key_type_pqc: Optional[pulumi.Input[_builtins.str]] = None,
|
|
855
|
+
key_size: Optional[pulumi.Input[_builtins.int]] = None,
|
|
856
|
+
min_decryption_version: Optional[pulumi.Input[_builtins.int]] = None,
|
|
857
|
+
min_encryption_version: Optional[pulumi.Input[_builtins.int]] = None,
|
|
858
|
+
name: Optional[pulumi.Input[_builtins.str]] = None,
|
|
859
|
+
namespace: Optional[pulumi.Input[_builtins.str]] = None,
|
|
860
|
+
parameter_set: Optional[pulumi.Input[_builtins.str]] = None,
|
|
861
|
+
type: Optional[pulumi.Input[_builtins.str]] = None,
|
|
843
862
|
__props__=None):
|
|
844
863
|
opts = pulumi.ResourceOptions.merge(_utilities.get_resource_opts_defaults(), opts)
|
|
845
864
|
if not isinstance(opts, pulumi.ResourceOptions):
|
|
@@ -884,29 +903,29 @@ class SecretBackendKey(pulumi.CustomResource):
|
|
|
884
903
|
def get(resource_name: str,
|
|
885
904
|
id: pulumi.Input[str],
|
|
886
905
|
opts: Optional[pulumi.ResourceOptions] = None,
|
|
887
|
-
allow_plaintext_backup: Optional[pulumi.Input[
|
|
888
|
-
auto_rotate_period: Optional[pulumi.Input[
|
|
889
|
-
backend: Optional[pulumi.Input[
|
|
890
|
-
convergent_encryption: Optional[pulumi.Input[
|
|
891
|
-
deletion_allowed: Optional[pulumi.Input[
|
|
892
|
-
derived: Optional[pulumi.Input[
|
|
893
|
-
exportable: Optional[pulumi.Input[
|
|
894
|
-
hybrid_key_type_ec: Optional[pulumi.Input[
|
|
895
|
-
hybrid_key_type_pqc: Optional[pulumi.Input[
|
|
896
|
-
key_size: Optional[pulumi.Input[
|
|
897
|
-
keys: Optional[pulumi.Input[Sequence[pulumi.Input[Mapping[str, pulumi.Input[
|
|
898
|
-
latest_version: Optional[pulumi.Input[
|
|
899
|
-
min_available_version: Optional[pulumi.Input[
|
|
900
|
-
min_decryption_version: Optional[pulumi.Input[
|
|
901
|
-
min_encryption_version: Optional[pulumi.Input[
|
|
902
|
-
name: Optional[pulumi.Input[
|
|
903
|
-
namespace: Optional[pulumi.Input[
|
|
904
|
-
parameter_set: Optional[pulumi.Input[
|
|
905
|
-
supports_decryption: Optional[pulumi.Input[
|
|
906
|
-
supports_derivation: Optional[pulumi.Input[
|
|
907
|
-
supports_encryption: Optional[pulumi.Input[
|
|
908
|
-
supports_signing: Optional[pulumi.Input[
|
|
909
|
-
type: Optional[pulumi.Input[
|
|
906
|
+
allow_plaintext_backup: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
907
|
+
auto_rotate_period: Optional[pulumi.Input[_builtins.int]] = None,
|
|
908
|
+
backend: Optional[pulumi.Input[_builtins.str]] = None,
|
|
909
|
+
convergent_encryption: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
910
|
+
deletion_allowed: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
911
|
+
derived: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
912
|
+
exportable: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
913
|
+
hybrid_key_type_ec: Optional[pulumi.Input[_builtins.str]] = None,
|
|
914
|
+
hybrid_key_type_pqc: Optional[pulumi.Input[_builtins.str]] = None,
|
|
915
|
+
key_size: Optional[pulumi.Input[_builtins.int]] = None,
|
|
916
|
+
keys: Optional[pulumi.Input[Sequence[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]]]] = None,
|
|
917
|
+
latest_version: Optional[pulumi.Input[_builtins.int]] = None,
|
|
918
|
+
min_available_version: Optional[pulumi.Input[_builtins.int]] = None,
|
|
919
|
+
min_decryption_version: Optional[pulumi.Input[_builtins.int]] = None,
|
|
920
|
+
min_encryption_version: Optional[pulumi.Input[_builtins.int]] = None,
|
|
921
|
+
name: Optional[pulumi.Input[_builtins.str]] = None,
|
|
922
|
+
namespace: Optional[pulumi.Input[_builtins.str]] = None,
|
|
923
|
+
parameter_set: Optional[pulumi.Input[_builtins.str]] = None,
|
|
924
|
+
supports_decryption: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
925
|
+
supports_derivation: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
926
|
+
supports_encryption: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
927
|
+
supports_signing: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
928
|
+
type: Optional[pulumi.Input[_builtins.str]] = None) -> 'SecretBackendKey':
|
|
910
929
|
"""
|
|
911
930
|
Get an existing SecretBackendKey resource's state with the given name, id, and optional extra
|
|
912
931
|
properties used to qualify the lookup.
|
|
@@ -914,39 +933,43 @@ class SecretBackendKey(pulumi.CustomResource):
|
|
|
914
933
|
:param str resource_name: The unique name of the resulting resource.
|
|
915
934
|
:param pulumi.Input[str] id: The unique provider ID of the resource to lookup.
|
|
916
935
|
:param pulumi.ResourceOptions opts: Options for the resource.
|
|
917
|
-
:param pulumi.Input[
|
|
936
|
+
:param pulumi.Input[_builtins.bool] allow_plaintext_backup: Enables taking backup of entire keyring in the plaintext format. Once set, this cannot be disabled.
|
|
918
937
|
* Refer to Vault API documentation on key backups for more information: [Backup Key](https://www.vaultproject.io/api-docs/secret/transit#backup-key)
|
|
919
|
-
:param pulumi.Input[
|
|
938
|
+
:param pulumi.Input[_builtins.int] auto_rotate_period: Amount of seconds the key should live before being automatically rotated.
|
|
920
939
|
A value of 0 disables automatic rotation for the key.
|
|
921
|
-
:param pulumi.Input[
|
|
922
|
-
:param pulumi.Input[
|
|
923
|
-
:param pulumi.Input[
|
|
924
|
-
:param pulumi.Input[
|
|
925
|
-
:param pulumi.Input[
|
|
926
|
-
:param pulumi.Input[
|
|
940
|
+
:param pulumi.Input[_builtins.str] backend: The path the transit secret backend is mounted at, with no leading or trailing `/`s.
|
|
941
|
+
:param pulumi.Input[_builtins.bool] convergent_encryption: Whether or not to support convergent encryption, where the same plaintext creates the same ciphertext. This requires `derived` to be set to `true`.
|
|
942
|
+
:param pulumi.Input[_builtins.bool] deletion_allowed: Specifies if the key is allowed to be deleted.
|
|
943
|
+
:param pulumi.Input[_builtins.bool] derived: Specifies if key derivation is to be used. If enabled, all encrypt/decrypt requests to this key must provide a context which is used for key derivation.
|
|
944
|
+
:param pulumi.Input[_builtins.bool] exportable: Enables keys to be exportable. This allows for all valid private keys in the keyring to be exported. Once set, this cannot be disabled.
|
|
945
|
+
:param pulumi.Input[_builtins.str] hybrid_key_type_ec: The elliptic curve algorithm to use for hybrid signatures.
|
|
927
946
|
Supported key types are `ecdsa-p256`, `ecdsa-p384`, `ecdsa-p521`, and `ed25519`.
|
|
928
|
-
:param pulumi.Input[
|
|
947
|
+
:param pulumi.Input[_builtins.str] hybrid_key_type_pqc: The post-quantum algorithm to use for hybrid signatures.
|
|
929
948
|
Currently, ML-DSA is the only supported key type.
|
|
930
|
-
:param pulumi.Input[
|
|
931
|
-
:param pulumi.Input[Sequence[pulumi.Input[Mapping[str, pulumi.Input[
|
|
949
|
+
:param pulumi.Input[_builtins.int] key_size: The key size in bytes for algorithms that allow variable key sizes. Currently only applicable to HMAC, where it must be between 32 and 512 bytes.
|
|
950
|
+
:param pulumi.Input[Sequence[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]]] keys: List of key versions in the keyring. This attribute is zero-indexed and will contain a map of values depending on the `type` of the encryption key.
|
|
932
951
|
* for key types `aes128-gcm96`, `aes256-gcm96` and `chacha20-poly1305`, each key version will be a map of a single value `id` which is just a hash of the key's metadata.
|
|
933
952
|
* for key types `ed25519`, `ecdsa-p256`, `ecdsa-p384`, `ecdsa-p521`, `rsa-2048`, `rsa-3072` and `rsa-4096`, each key version will be a map of the following:
|
|
934
|
-
:param pulumi.Input[
|
|
935
|
-
:param pulumi.Input[
|
|
936
|
-
:param pulumi.Input[
|
|
937
|
-
:param pulumi.Input[
|
|
938
|
-
:param pulumi.Input[
|
|
939
|
-
:param pulumi.Input[
|
|
953
|
+
:param pulumi.Input[_builtins.int] latest_version: Latest key version available. This value is 1-indexed, so if `latest_version` is `1`, then the key's information can be referenced from `keys` by selecting element `0`
|
|
954
|
+
:param pulumi.Input[_builtins.int] min_available_version: Minimum key version available for use. If keys have been archived by increasing `min_decryption_version`, this attribute will reflect that change.
|
|
955
|
+
:param pulumi.Input[_builtins.int] min_decryption_version: Minimum key version to use for decryption.
|
|
956
|
+
:param pulumi.Input[_builtins.int] min_encryption_version: Minimum key version to use for encryption
|
|
957
|
+
:param pulumi.Input[_builtins.str] name: The name to identify this key within the backend. Must be unique within the backend.
|
|
958
|
+
:param pulumi.Input[_builtins.str] namespace: The namespace to provision the resource in.
|
|
940
959
|
The value should not contain leading or trailing forward slashes.
|
|
941
960
|
The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).
|
|
942
961
|
*Available only for Vault Enterprise*.
|
|
943
|
-
:param pulumi.Input[
|
|
944
|
-
ML-DSA and
|
|
945
|
-
|
|
946
|
-
|
|
947
|
-
|
|
948
|
-
|
|
949
|
-
:param pulumi.Input[
|
|
962
|
+
:param pulumi.Input[_builtins.str] parameter_set: The parameter set to use for ML-DSA or SLH-DSA. Required for
|
|
963
|
+
ML-DSA, hybrid, and SLH-DSA keys.
|
|
964
|
+
Valid values for ML-DSA are `44`, `65`, and `87`.
|
|
965
|
+
Valid values for SLH-DSA are `slh-dsa-sha2-128s`, `slh-dsa-shake-128s`, `slh-dsa-sha2-128f`, `slh-dsa-shake-128`, `slh-dsa-sha2-192s`,
|
|
966
|
+
`slh-dsa-shake-192s`, `slh-dsa-sha2-192f`, `slh-dsa-shake-192f`, `slh-dsa-sha2-256s`, `slh-dsa-shake-256s`,
|
|
967
|
+
`slh-dsa-sha2-256f`, and `slh-dsa-shake-256f`.
|
|
968
|
+
:param pulumi.Input[_builtins.bool] supports_decryption: Whether or not the key supports decryption, based on key type.
|
|
969
|
+
:param pulumi.Input[_builtins.bool] supports_derivation: Whether or not the key supports derivation, based on key type.
|
|
970
|
+
:param pulumi.Input[_builtins.bool] supports_encryption: Whether or not the key supports encryption, based on key type.
|
|
971
|
+
:param pulumi.Input[_builtins.bool] supports_signing: Whether or not the key supports signing, based on key type.
|
|
972
|
+
:param pulumi.Input[_builtins.str] type: Specifies the type of key to create. The currently-supported types are: `aes128-gcm96`, `aes256-gcm96` (default), `chacha20-poly1305`, `ed25519`, `ecdsa-p256`, `ecdsa-p384`, `ecdsa-p521`, `hmac`, `rsa-2048`, `rsa-3072`, `rsa-4096`, `managed_key`, `aes128-cmac`, `aes192-cmac`, `aes256-cmac`, `ml-dsa`, `hybrid`, and `slh-dsa`.
|
|
950
973
|
* Refer to the Vault documentation on transit key types for more information: [Key Types](https://www.vaultproject.io/docs/secrets/transit#key-types)
|
|
951
974
|
"""
|
|
952
975
|
opts = pulumi.ResourceOptions.merge(opts, pulumi.ResourceOptions(id=id))
|
|
@@ -978,93 +1001,93 @@ class SecretBackendKey(pulumi.CustomResource):
|
|
|
978
1001
|
__props__.__dict__["type"] = type
|
|
979
1002
|
return SecretBackendKey(resource_name, opts=opts, __props__=__props__)
|
|
980
1003
|
|
|
981
|
-
@property
|
|
1004
|
+
@_builtins.property
|
|
982
1005
|
@pulumi.getter(name="allowPlaintextBackup")
|
|
983
|
-
def allow_plaintext_backup(self) -> pulumi.Output[Optional[
|
|
1006
|
+
def allow_plaintext_backup(self) -> pulumi.Output[Optional[_builtins.bool]]:
|
|
984
1007
|
"""
|
|
985
1008
|
Enables taking backup of entire keyring in the plaintext format. Once set, this cannot be disabled.
|
|
986
1009
|
* Refer to Vault API documentation on key backups for more information: [Backup Key](https://www.vaultproject.io/api-docs/secret/transit#backup-key)
|
|
987
1010
|
"""
|
|
988
1011
|
return pulumi.get(self, "allow_plaintext_backup")
|
|
989
1012
|
|
|
990
|
-
@property
|
|
1013
|
+
@_builtins.property
|
|
991
1014
|
@pulumi.getter(name="autoRotatePeriod")
|
|
992
|
-
def auto_rotate_period(self) -> pulumi.Output[
|
|
1015
|
+
def auto_rotate_period(self) -> pulumi.Output[_builtins.int]:
|
|
993
1016
|
"""
|
|
994
1017
|
Amount of seconds the key should live before being automatically rotated.
|
|
995
1018
|
A value of 0 disables automatic rotation for the key.
|
|
996
1019
|
"""
|
|
997
1020
|
return pulumi.get(self, "auto_rotate_period")
|
|
998
1021
|
|
|
999
|
-
@property
|
|
1022
|
+
@_builtins.property
|
|
1000
1023
|
@pulumi.getter
|
|
1001
|
-
def backend(self) -> pulumi.Output[
|
|
1024
|
+
def backend(self) -> pulumi.Output[_builtins.str]:
|
|
1002
1025
|
"""
|
|
1003
1026
|
The path the transit secret backend is mounted at, with no leading or trailing `/`s.
|
|
1004
1027
|
"""
|
|
1005
1028
|
return pulumi.get(self, "backend")
|
|
1006
1029
|
|
|
1007
|
-
@property
|
|
1030
|
+
@_builtins.property
|
|
1008
1031
|
@pulumi.getter(name="convergentEncryption")
|
|
1009
|
-
def convergent_encryption(self) -> pulumi.Output[Optional[
|
|
1032
|
+
def convergent_encryption(self) -> pulumi.Output[Optional[_builtins.bool]]:
|
|
1010
1033
|
"""
|
|
1011
1034
|
Whether or not to support convergent encryption, where the same plaintext creates the same ciphertext. This requires `derived` to be set to `true`.
|
|
1012
1035
|
"""
|
|
1013
1036
|
return pulumi.get(self, "convergent_encryption")
|
|
1014
1037
|
|
|
1015
|
-
@property
|
|
1038
|
+
@_builtins.property
|
|
1016
1039
|
@pulumi.getter(name="deletionAllowed")
|
|
1017
|
-
def deletion_allowed(self) -> pulumi.Output[Optional[
|
|
1040
|
+
def deletion_allowed(self) -> pulumi.Output[Optional[_builtins.bool]]:
|
|
1018
1041
|
"""
|
|
1019
1042
|
Specifies if the key is allowed to be deleted.
|
|
1020
1043
|
"""
|
|
1021
1044
|
return pulumi.get(self, "deletion_allowed")
|
|
1022
1045
|
|
|
1023
|
-
@property
|
|
1046
|
+
@_builtins.property
|
|
1024
1047
|
@pulumi.getter
|
|
1025
|
-
def derived(self) -> pulumi.Output[Optional[
|
|
1048
|
+
def derived(self) -> pulumi.Output[Optional[_builtins.bool]]:
|
|
1026
1049
|
"""
|
|
1027
1050
|
Specifies if key derivation is to be used. If enabled, all encrypt/decrypt requests to this key must provide a context which is used for key derivation.
|
|
1028
1051
|
"""
|
|
1029
1052
|
return pulumi.get(self, "derived")
|
|
1030
1053
|
|
|
1031
|
-
@property
|
|
1054
|
+
@_builtins.property
|
|
1032
1055
|
@pulumi.getter
|
|
1033
|
-
def exportable(self) -> pulumi.Output[Optional[
|
|
1056
|
+
def exportable(self) -> pulumi.Output[Optional[_builtins.bool]]:
|
|
1034
1057
|
"""
|
|
1035
1058
|
Enables keys to be exportable. This allows for all valid private keys in the keyring to be exported. Once set, this cannot be disabled.
|
|
1036
1059
|
"""
|
|
1037
1060
|
return pulumi.get(self, "exportable")
|
|
1038
1061
|
|
|
1039
|
-
@property
|
|
1062
|
+
@_builtins.property
|
|
1040
1063
|
@pulumi.getter(name="hybridKeyTypeEc")
|
|
1041
|
-
def hybrid_key_type_ec(self) -> pulumi.Output[Optional[
|
|
1064
|
+
def hybrid_key_type_ec(self) -> pulumi.Output[Optional[_builtins.str]]:
|
|
1042
1065
|
"""
|
|
1043
1066
|
The elliptic curve algorithm to use for hybrid signatures.
|
|
1044
1067
|
Supported key types are `ecdsa-p256`, `ecdsa-p384`, `ecdsa-p521`, and `ed25519`.
|
|
1045
1068
|
"""
|
|
1046
1069
|
return pulumi.get(self, "hybrid_key_type_ec")
|
|
1047
1070
|
|
|
1048
|
-
@property
|
|
1071
|
+
@_builtins.property
|
|
1049
1072
|
@pulumi.getter(name="hybridKeyTypePqc")
|
|
1050
|
-
def hybrid_key_type_pqc(self) -> pulumi.Output[Optional[
|
|
1073
|
+
def hybrid_key_type_pqc(self) -> pulumi.Output[Optional[_builtins.str]]:
|
|
1051
1074
|
"""
|
|
1052
1075
|
The post-quantum algorithm to use for hybrid signatures.
|
|
1053
1076
|
Currently, ML-DSA is the only supported key type.
|
|
1054
1077
|
"""
|
|
1055
1078
|
return pulumi.get(self, "hybrid_key_type_pqc")
|
|
1056
1079
|
|
|
1057
|
-
@property
|
|
1080
|
+
@_builtins.property
|
|
1058
1081
|
@pulumi.getter(name="keySize")
|
|
1059
|
-
def key_size(self) -> pulumi.Output[Optional[
|
|
1082
|
+
def key_size(self) -> pulumi.Output[Optional[_builtins.int]]:
|
|
1060
1083
|
"""
|
|
1061
1084
|
The key size in bytes for algorithms that allow variable key sizes. Currently only applicable to HMAC, where it must be between 32 and 512 bytes.
|
|
1062
1085
|
"""
|
|
1063
1086
|
return pulumi.get(self, "key_size")
|
|
1064
1087
|
|
|
1065
|
-
@property
|
|
1088
|
+
@_builtins.property
|
|
1066
1089
|
@pulumi.getter
|
|
1067
|
-
def keys(self) -> pulumi.Output[Sequence[Mapping[str,
|
|
1090
|
+
def keys(self) -> pulumi.Output[Sequence[Mapping[str, _builtins.str]]]:
|
|
1068
1091
|
"""
|
|
1069
1092
|
List of key versions in the keyring. This attribute is zero-indexed and will contain a map of values depending on the `type` of the encryption key.
|
|
1070
1093
|
* for key types `aes128-gcm96`, `aes256-gcm96` and `chacha20-poly1305`, each key version will be a map of a single value `id` which is just a hash of the key's metadata.
|
|
@@ -1072,49 +1095,49 @@ class SecretBackendKey(pulumi.CustomResource):
|
|
|
1072
1095
|
"""
|
|
1073
1096
|
return pulumi.get(self, "keys")
|
|
1074
1097
|
|
|
1075
|
-
@property
|
|
1098
|
+
@_builtins.property
|
|
1076
1099
|
@pulumi.getter(name="latestVersion")
|
|
1077
|
-
def latest_version(self) -> pulumi.Output[
|
|
1100
|
+
def latest_version(self) -> pulumi.Output[_builtins.int]:
|
|
1078
1101
|
"""
|
|
1079
1102
|
Latest key version available. This value is 1-indexed, so if `latest_version` is `1`, then the key's information can be referenced from `keys` by selecting element `0`
|
|
1080
1103
|
"""
|
|
1081
1104
|
return pulumi.get(self, "latest_version")
|
|
1082
1105
|
|
|
1083
|
-
@property
|
|
1106
|
+
@_builtins.property
|
|
1084
1107
|
@pulumi.getter(name="minAvailableVersion")
|
|
1085
|
-
def min_available_version(self) -> pulumi.Output[
|
|
1108
|
+
def min_available_version(self) -> pulumi.Output[_builtins.int]:
|
|
1086
1109
|
"""
|
|
1087
1110
|
Minimum key version available for use. If keys have been archived by increasing `min_decryption_version`, this attribute will reflect that change.
|
|
1088
1111
|
"""
|
|
1089
1112
|
return pulumi.get(self, "min_available_version")
|
|
1090
1113
|
|
|
1091
|
-
@property
|
|
1114
|
+
@_builtins.property
|
|
1092
1115
|
@pulumi.getter(name="minDecryptionVersion")
|
|
1093
|
-
def min_decryption_version(self) -> pulumi.Output[Optional[
|
|
1116
|
+
def min_decryption_version(self) -> pulumi.Output[Optional[_builtins.int]]:
|
|
1094
1117
|
"""
|
|
1095
1118
|
Minimum key version to use for decryption.
|
|
1096
1119
|
"""
|
|
1097
1120
|
return pulumi.get(self, "min_decryption_version")
|
|
1098
1121
|
|
|
1099
|
-
@property
|
|
1122
|
+
@_builtins.property
|
|
1100
1123
|
@pulumi.getter(name="minEncryptionVersion")
|
|
1101
|
-
def min_encryption_version(self) -> pulumi.Output[Optional[
|
|
1124
|
+
def min_encryption_version(self) -> pulumi.Output[Optional[_builtins.int]]:
|
|
1102
1125
|
"""
|
|
1103
1126
|
Minimum key version to use for encryption
|
|
1104
1127
|
"""
|
|
1105
1128
|
return pulumi.get(self, "min_encryption_version")
|
|
1106
1129
|
|
|
1107
|
-
@property
|
|
1130
|
+
@_builtins.property
|
|
1108
1131
|
@pulumi.getter
|
|
1109
|
-
def name(self) -> pulumi.Output[
|
|
1132
|
+
def name(self) -> pulumi.Output[_builtins.str]:
|
|
1110
1133
|
"""
|
|
1111
1134
|
The name to identify this key within the backend. Must be unique within the backend.
|
|
1112
1135
|
"""
|
|
1113
1136
|
return pulumi.get(self, "name")
|
|
1114
1137
|
|
|
1115
|
-
@property
|
|
1138
|
+
@_builtins.property
|
|
1116
1139
|
@pulumi.getter
|
|
1117
|
-
def namespace(self) -> pulumi.Output[Optional[
|
|
1140
|
+
def namespace(self) -> pulumi.Output[Optional[_builtins.str]]:
|
|
1118
1141
|
"""
|
|
1119
1142
|
The namespace to provision the resource in.
|
|
1120
1143
|
The value should not contain leading or trailing forward slashes.
|
|
@@ -1123,52 +1146,56 @@ class SecretBackendKey(pulumi.CustomResource):
|
|
|
1123
1146
|
"""
|
|
1124
1147
|
return pulumi.get(self, "namespace")
|
|
1125
1148
|
|
|
1126
|
-
@property
|
|
1149
|
+
@_builtins.property
|
|
1127
1150
|
@pulumi.getter(name="parameterSet")
|
|
1128
|
-
def parameter_set(self) -> pulumi.Output[Optional[
|
|
1151
|
+
def parameter_set(self) -> pulumi.Output[Optional[_builtins.str]]:
|
|
1129
1152
|
"""
|
|
1130
|
-
The parameter set to use for ML-DSA. Required for
|
|
1131
|
-
ML-DSA and
|
|
1153
|
+
The parameter set to use for ML-DSA or SLH-DSA. Required for
|
|
1154
|
+
ML-DSA, hybrid, and SLH-DSA keys.
|
|
1155
|
+
Valid values for ML-DSA are `44`, `65`, and `87`.
|
|
1156
|
+
Valid values for SLH-DSA are `slh-dsa-sha2-128s`, `slh-dsa-shake-128s`, `slh-dsa-sha2-128f`, `slh-dsa-shake-128`, `slh-dsa-sha2-192s`,
|
|
1157
|
+
`slh-dsa-shake-192s`, `slh-dsa-sha2-192f`, `slh-dsa-shake-192f`, `slh-dsa-sha2-256s`, `slh-dsa-shake-256s`,
|
|
1158
|
+
`slh-dsa-sha2-256f`, and `slh-dsa-shake-256f`.
|
|
1132
1159
|
"""
|
|
1133
1160
|
return pulumi.get(self, "parameter_set")
|
|
1134
1161
|
|
|
1135
|
-
@property
|
|
1162
|
+
@_builtins.property
|
|
1136
1163
|
@pulumi.getter(name="supportsDecryption")
|
|
1137
|
-
def supports_decryption(self) -> pulumi.Output[
|
|
1164
|
+
def supports_decryption(self) -> pulumi.Output[_builtins.bool]:
|
|
1138
1165
|
"""
|
|
1139
1166
|
Whether or not the key supports decryption, based on key type.
|
|
1140
1167
|
"""
|
|
1141
1168
|
return pulumi.get(self, "supports_decryption")
|
|
1142
1169
|
|
|
1143
|
-
@property
|
|
1170
|
+
@_builtins.property
|
|
1144
1171
|
@pulumi.getter(name="supportsDerivation")
|
|
1145
|
-
def supports_derivation(self) -> pulumi.Output[
|
|
1172
|
+
def supports_derivation(self) -> pulumi.Output[_builtins.bool]:
|
|
1146
1173
|
"""
|
|
1147
1174
|
Whether or not the key supports derivation, based on key type.
|
|
1148
1175
|
"""
|
|
1149
1176
|
return pulumi.get(self, "supports_derivation")
|
|
1150
1177
|
|
|
1151
|
-
@property
|
|
1178
|
+
@_builtins.property
|
|
1152
1179
|
@pulumi.getter(name="supportsEncryption")
|
|
1153
|
-
def supports_encryption(self) -> pulumi.Output[
|
|
1180
|
+
def supports_encryption(self) -> pulumi.Output[_builtins.bool]:
|
|
1154
1181
|
"""
|
|
1155
1182
|
Whether or not the key supports encryption, based on key type.
|
|
1156
1183
|
"""
|
|
1157
1184
|
return pulumi.get(self, "supports_encryption")
|
|
1158
1185
|
|
|
1159
|
-
@property
|
|
1186
|
+
@_builtins.property
|
|
1160
1187
|
@pulumi.getter(name="supportsSigning")
|
|
1161
|
-
def supports_signing(self) -> pulumi.Output[
|
|
1188
|
+
def supports_signing(self) -> pulumi.Output[_builtins.bool]:
|
|
1162
1189
|
"""
|
|
1163
1190
|
Whether or not the key supports signing, based on key type.
|
|
1164
1191
|
"""
|
|
1165
1192
|
return pulumi.get(self, "supports_signing")
|
|
1166
1193
|
|
|
1167
|
-
@property
|
|
1194
|
+
@_builtins.property
|
|
1168
1195
|
@pulumi.getter
|
|
1169
|
-
def type(self) -> pulumi.Output[Optional[
|
|
1196
|
+
def type(self) -> pulumi.Output[Optional[_builtins.str]]:
|
|
1170
1197
|
"""
|
|
1171
|
-
Specifies the type of key to create. The currently-supported types are: `aes128-gcm96`, `aes256-gcm96` (default), `chacha20-poly1305`, `ed25519`, `ecdsa-p256`, `ecdsa-p384`, `ecdsa-p521`, `hmac`, `rsa-2048`, `rsa-3072` and `
|
|
1198
|
+
Specifies the type of key to create. The currently-supported types are: `aes128-gcm96`, `aes256-gcm96` (default), `chacha20-poly1305`, `ed25519`, `ecdsa-p256`, `ecdsa-p384`, `ecdsa-p521`, `hmac`, `rsa-2048`, `rsa-3072`, `rsa-4096`, `managed_key`, `aes128-cmac`, `aes192-cmac`, `aes256-cmac`, `ml-dsa`, `hybrid`, and `slh-dsa`.
|
|
1172
1199
|
* Refer to the Vault documentation on transit key types for more information: [Key Types](https://www.vaultproject.io/docs/secrets/transit#key-types)
|
|
1173
1200
|
"""
|
|
1174
1201
|
return pulumi.get(self, "type")
|